<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
  <generator>
    <oval:product_name>python</oval:product_name>
    <oval:product_version>2.6.6</oval:product_version>
    <oval:schema_version>5.11</oval:schema_version>
    <oval:timestamp>2016-11-28T20:31:16</oval:timestamp>
  </generator>
  <definitions>
    <definition class="compliance" id="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1" version="1">
      <metadata>
        <title>Specify Multiple Remote chronyd Or ntpd NTP Servers for Time Data</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Multiple remote chronyd or ntpd NTP Servers for time synchronization should be specified (and dependencies are met)</description>
      <reference source="ssg" ref_id="chronyd_or_ntpd_specify_multiple_servers"/></metadata>
      <criteria operator="OR">
        <criteria comment="chronyd enabled and multiple remote servers specified" operator="AND">
          <extend_definition comment="service chronyd enabled" definition_ref="oval:ssg-service_chronyd_enabled:def:1"/>
          <extend_definition comment="multiple chronyd remote servers specified" definition_ref="oval:ssg-chronyd_specify_multiple_servers:def:1"/>
        </criteria>
        <criteria comment="ntpd enabled and multile remote servers specified" operator="AND">
          <extend_definition comment="service ntpd enabled" definition_ref="oval:ssg-service_ntpd_enabled:def:1"/>
          <extend_definition comment="multiple ntpd remote servers specified" definition_ref="oval:ssg-ntpd_specify_multiple_servers:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-chronyd_or_ntpd_specify_remote_server:def:1" version="1">
      <metadata>
        <title>Specify Remote NTP chronyd Or ntpd Server for Time Data</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>A remote chronyd or ntpd NTP Server for time synchronization should be specified (and dependencies are met)</description>
      <reference source="ssg" ref_id="chronyd_or_ntpd_specify_remote_server"/></metadata>
      <criteria operator="OR">
        <criteria comment="chronyd enabled and remote server specified" operator="AND">
          <extend_definition comment="service chronyd enabled" definition_ref="oval:ssg-service_chronyd_enabled:def:1"/>
          <extend_definition comment="chronyd remote server specified" definition_ref="oval:ssg-chronyd_specify_remote_server:def:1"/>
        </criteria>
        <criteria comment="ntpd enabled and remote server specified" operator="AND">
          <extend_definition comment="service ntpd enabled" definition_ref="oval:ssg-service_ntpd_enabled:def:1"/>
          <extend_definition comment="ntpd remote server specified" definition_ref="oval:ssg-ntpd_specify_remote_server:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-docker_selinux_enabled:def:1" version="1">
      <metadata>
        <title>Ensure SELinux support is enabled in Docker</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The Docker daemon should be configured to start with --selinux-enabled option to enable SELinux for the daemon.</description>
      <reference source="ssg" ref_id="docker_selinux_enabled"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <extend_definition comment="docker service active on system" definition_ref="oval:ssg-service_docker_enabled:def:1"/>
          <criterion comment="Docker is configured to run with SELinux support" test_ref="oval:ssg-test_docker_selinux_enabled:tst:1"/>
        </criteria>
        <extend_definition comment="docker service inactive on system" definition_ref="oval:ssg-service_docker_enabled:def:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-docker_storage_configured:def:1" version="1">
      <metadata>
        <title>Use direct-lvm with device mapper storage driver</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>To use Docker in production with the device mapper storage driver, the Docker daemon should be configured to use direct-lvm instead of loopback device as a storage.</description>
      <reference source="ssg" ref_id="docker_storage_configured"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <extend_definition comment="docker service is active on system" definition_ref="oval:ssg-service_docker_enabled:def:1"/>
          <criteria operator="OR">
            <criteria operator="AND">
              <criterion comment="Docker uses devicemapper as a storage driver" test_ref="oval:ssg-test_docker_devicemapper:tst:1"/>
              <criterion comment="Docker is configured to use a thinpool device" test_ref="oval:ssg-test_docker_thinpool_device:tst:1"/>
              <criterion comment="The thinpool device configured to be used by Docker exists on the system" test_ref="oval:ssg-test_device_exists:tst:1"/>
            </criteria>
            <criterion comment="Docker does not use devicemapper as a storage driver" test_ref="oval:ssg-test_docker_devicemapper:tst:1" negate="true"/>
          </criteria>
        </criteria>
        <extend_definition comment="Docker service is inactive on system" definition_ref="oval:ssg-service_docker_enabled:def:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_abrt_removed:def:1" version="1">
      <metadata>
        <title>Package abrt Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package abrt should be removed.</description>
      <reference source="ssg" ref_id="package_abrt_removed"/></metadata>
      <criteria>
        <criterion comment="package abrt is removed" test_ref="oval:ssg-test_package_abrt_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_acpid_removed:def:1" version="1">
      <metadata>
        <title>Package acpid Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package acpid should be removed.</description>
      <reference source="ssg" ref_id="package_acpid_removed"/></metadata>
      <criteria>
        <criterion comment="package acpid is removed" test_ref="oval:ssg-test_package_acpid_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_at_removed:def:1" version="1">
      <metadata>
        <title>Package at Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package at should be removed.</description>
      <reference source="ssg" ref_id="package_at_removed"/></metadata>
      <criteria>
        <criterion comment="package at is removed" test_ref="oval:ssg-test_package_at_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_autofs_removed:def:1" version="1">
      <metadata>
        <title>Package autofs Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package autofs should be removed.</description>
      <reference source="ssg" ref_id="package_autofs_removed"/></metadata>
      <criteria>
        <criterion comment="package autofs is removed" test_ref="oval:ssg-test_package_autofs_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_avahi_removed:def:1" version="1">
      <metadata>
        <title>Package avahi Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package avahi should be removed.</description>
      <reference source="ssg" ref_id="package_avahi_removed"/></metadata>
      <criteria>
        <criterion comment="package avahi is removed" test_ref="oval:ssg-test_package_avahi_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_bind_removed:def:1" version="1">
      <metadata>
        <title>Package bind Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package bind should be removed.</description>
      <reference source="ssg" ref_id="package_bind_removed"/></metadata>
      <criteria>
        <criterion comment="package bind is removed" test_ref="oval:ssg-test_package_bind_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_bluez_removed:def:1" version="1">
      <metadata>
        <title>Package bluez Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package bluez should be removed.</description>
      <reference source="ssg" ref_id="package_bluez_removed"/></metadata>
      <criteria>
        <criterion comment="package bluez is removed" test_ref="oval:ssg-test_package_bluez_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_certmonger_removed:def:1" version="1">
      <metadata>
        <title>Package certmonger Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package certmonger should be removed.</description>
      <reference source="ssg" ref_id="package_certmonger_removed"/></metadata>
      <criteria>
        <criterion comment="package certmonger is removed" test_ref="oval:ssg-test_package_certmonger_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_cups_removed:def:1" version="1">
      <metadata>
        <title>Package cups Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package cups should be removed.</description>
      <reference source="ssg" ref_id="package_cups_removed"/></metadata>
      <criteria>
        <criterion comment="package cups is removed" test_ref="oval:ssg-test_package_cups_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_cyrus-sasl_removed:def:1" version="1">
      <metadata>
        <title>Package cyrus-sasl Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package cyrus-sasl should be removed.</description>
      <reference source="ssg" ref_id="package_cyrus-sasl_removed"/></metadata>
      <criteria>
        <criterion comment="package cyrus-sasl is removed" test_ref="oval:ssg-test_package_cyrus-sasl_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_dbus_removed:def:1" version="1">
      <metadata>
        <title>Package dbus Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package dbus should be removed.</description>
      <reference source="ssg" ref_id="package_dbus_removed"/></metadata>
      <criteria>
        <criterion comment="package dbus is removed" test_ref="oval:ssg-test_package_dbus_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_dhcp_removed:def:1" version="1">
      <metadata>
        <title>Package dhcp Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package dhcp should be removed.</description>
      <reference source="ssg" ref_id="package_dhcp_removed"/></metadata>
      <criteria>
        <criterion comment="package dhcp is removed" test_ref="oval:ssg-test_package_dhcp_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_docker_installed:def:1" version="1">
      <metadata>
        <title>Package docker Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package docker should be installed.</description>
      <reference source="ssg" ref_id="package_docker_installed"/></metadata>
      <criteria>
        <criterion comment="package docker is installed" test_ref="oval:ssg-test_package_docker_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_dovecot_removed:def:1" version="1">
      <metadata>
        <title>Package dovecot Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package dovecot should be removed.</description>
      <reference source="ssg" ref_id="package_dovecot_removed"/></metadata>
      <criteria>
        <criterion comment="package dovecot is removed" test_ref="oval:ssg-test_package_dovecot_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_esc_installed:def:1" version="1">
      <metadata>
        <title>Package esc Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package esc should be installed.</description>
      <reference source="ssg" ref_id="package_esc_installed"/></metadata>
      <criteria>
        <criterion comment="package esc is installed" test_ref="oval:ssg-test_package_esc_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_httpd_removed:def:1" version="1">
      <metadata>
        <title>Package httpd Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package httpd should be removed.</description>
      <reference source="ssg" ref_id="package_httpd_removed"/></metadata>
      <criteria>
        <criterion comment="package httpd is removed" test_ref="oval:ssg-test_package_httpd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_iputils_removed:def:1" version="1">
      <metadata>
        <title>Package iputils Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package iputils should be removed.</description>
      <reference source="ssg" ref_id="package_iputils_removed"/></metadata>
      <criteria>
        <criterion comment="package iputils is removed" test_ref="oval:ssg-test_package_iputils_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_irqbalance_installed:def:1" version="1">
      <metadata>
        <title>Package irqbalance Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package irqbalance should be installed.</description>
      <reference source="ssg" ref_id="package_irqbalance_installed"/></metadata>
      <criteria>
        <criterion comment="package irqbalance is installed" test_ref="oval:ssg-test_package_irqbalance_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_kernel-tools_removed:def:1" version="1">
      <metadata>
        <title>Package kernel-tools Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package kernel-tools should be removed.</description>
      <reference source="ssg" ref_id="package_kernel-tools_removed"/></metadata>
      <criteria>
        <criterion comment="package kernel-tools is removed" test_ref="oval:ssg-test_package_kernel-tools_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_kexec-tools_removed:def:1" version="1">
      <metadata>
        <title>Package kexec-tools Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package kexec-tools should be removed.</description>
      <reference source="ssg" ref_id="package_kexec-tools_removed"/></metadata>
      <criteria>
        <criterion comment="package kexec-tools is removed" test_ref="oval:ssg-test_package_kexec-tools_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_libcgroup-tools_removed:def:1" version="1">
      <metadata>
        <title>Package libcgroup-tools Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package libcgroup-tools should be removed.</description>
      <reference source="ssg" ref_id="package_libcgroup-tools_removed"/></metadata>
      <criteria>
        <criterion comment="package libcgroup-tools is removed" test_ref="oval:ssg-test_package_libcgroup-tools_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_libcgroup_removed:def:1" version="1">
      <metadata>
        <title>Package libcgroup Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package libcgroup should be removed.</description>
      <reference source="ssg" ref_id="package_libcgroup_removed"/></metadata>
      <criteria>
        <criterion comment="package libcgroup is removed" test_ref="oval:ssg-test_package_libcgroup_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_mdadm_removed:def:1" version="1">
      <metadata>
        <title>Package mdadm Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package mdadm should be removed.</description>
      <reference source="ssg" ref_id="package_mdadm_removed"/></metadata>
      <criteria>
        <criterion comment="package mdadm is removed" test_ref="oval:ssg-test_package_mdadm_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_net-snmp_removed:def:1" version="1">
      <metadata>
        <title>Package net-snmp Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package net-snmp should be removed.</description>
      <reference source="ssg" ref_id="package_net-snmp_removed"/></metadata>
      <criteria>
        <criterion comment="package net-snmp is removed" test_ref="oval:ssg-test_package_net-snmp_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_nfs-utils_removed:def:1" version="1">
      <metadata>
        <title>Package nfs-utils Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package nfs-utils should be removed.</description>
      <reference source="ssg" ref_id="package_nfs-utils_removed"/></metadata>
      <criteria>
        <criterion comment="package nfs-utils is removed" test_ref="oval:ssg-test_package_nfs-utils_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ntp_installed:def:1" version="1">
      <metadata>
        <title>Package ntp Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package ntp should be installed.</description>
      <reference source="ssg" ref_id="package_ntp_installed"/></metadata>
      <criteria>
        <criterion comment="package ntp is installed" test_ref="oval:ssg-test_package_ntp_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ntpdate_removed:def:1" version="1">
      <metadata>
        <title>Package ntpdate Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package ntpdate should be removed.</description>
      <reference source="ssg" ref_id="package_ntpdate_removed"/></metadata>
      <criteria>
        <criterion comment="package ntpdate is removed" test_ref="oval:ssg-test_package_ntpdate_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_oddjob_removed:def:1" version="1">
      <metadata>
        <title>Package oddjob Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package oddjob should be removed.</description>
      <reference source="ssg" ref_id="package_oddjob_removed"/></metadata>
      <criteria>
        <criterion comment="package oddjob is removed" test_ref="oval:ssg-test_package_oddjob_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_openssh-server_installed:def:1" version="1">
      <metadata>
        <title>Package openssh-server Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package openssh-server should be installed.</description>
      <reference source="ssg" ref_id="package_openssh-server_installed"/></metadata>
      <criteria>
        <criterion comment="package openssh-server is installed" test_ref="oval:ssg-test_package_openssh-server_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_openssh-server_removed:def:1" version="1">
      <metadata>
        <title>Package openssh-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package openssh-server should be removed.</description>
      <reference source="ssg" ref_id="package_openssh-server_removed"/></metadata>
      <criteria>
        <criterion comment="package openssh-server is removed" test_ref="oval:ssg-test_package_openssh-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_pam_pkcs11_installed:def:1" version="1">
      <metadata>
        <title>Package pam_pkcs11 Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package pam_pkcs11 should be installed.</description>
      <reference source="ssg" ref_id="package_pam_pkcs11_installed"/></metadata>
      <criteria>
        <criterion comment="package pam_pkcs11 is installed" test_ref="oval:ssg-test_package_pam_pkcs11_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_pcsc-lite_installed:def:1" version="1">
      <metadata>
        <title>Package pcsc-lite Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package pcsc-lite should be installed.</description>
      <reference source="ssg" ref_id="package_pcsc-lite_installed"/></metadata>
      <criteria>
        <criterion comment="package pcsc-lite is installed" test_ref="oval:ssg-test_package_pcsc-lite_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_portreserve_removed:def:1" version="1">
      <metadata>
        <title>Package portreserve Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package portreserve should be removed.</description>
      <reference source="ssg" ref_id="package_portreserve_removed"/></metadata>
      <criteria>
        <criterion comment="package portreserve is removed" test_ref="oval:ssg-test_package_portreserve_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_postfix_installed:def:1" version="1">
      <metadata>
        <title>Package postfix Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package postfix should be installed.</description>
      <reference source="ssg" ref_id="package_postfix_installed"/></metadata>
      <criteria>
        <criterion comment="package postfix is installed" test_ref="oval:ssg-test_package_postfix_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_psacct_installed:def:1" version="1">
      <metadata>
        <title>Package psacct Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package psacct should be installed.</description>
      <reference source="ssg" ref_id="package_psacct_installed"/></metadata>
      <criteria>
        <criterion comment="package psacct is installed" test_ref="oval:ssg-test_package_psacct_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_qpid-cpp-server_removed:def:1" version="1">
      <metadata>
        <title>Package qpid-cpp-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package qpid-cpp-server should be removed.</description>
      <reference source="ssg" ref_id="package_qpid-cpp-server_removed"/></metadata>
      <criteria>
        <criterion comment="package qpid-cpp-server is removed" test_ref="oval:ssg-test_package_qpid-cpp-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_quagga_removed:def:1" version="1">
      <metadata>
        <title>Package quagga Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package quagga should be removed.</description>
      <reference source="ssg" ref_id="package_quagga_removed"/></metadata>
      <criteria>
        <criterion comment="package quagga is removed" test_ref="oval:ssg-test_package_quagga_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_quota-nld_removed:def:1" version="1">
      <metadata>
        <title>Package quota-nld Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package quota-nld should be removed.</description>
      <reference source="ssg" ref_id="package_quota-nld_removed"/></metadata>
      <criteria>
        <criterion comment="package quota-nld is removed" test_ref="oval:ssg-test_package_quota-nld_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_rhnsd_removed:def:1" version="1">
      <metadata>
        <title>Package rhnsd Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package rhnsd should be removed.</description>
      <reference source="ssg" ref_id="package_rhnsd_removed"/></metadata>
      <criteria>
        <criterion comment="package rhnsd is removed" test_ref="oval:ssg-test_package_rhnsd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_samba_removed:def:1" version="1">
      <metadata>
        <title>Package samba Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package samba should be removed.</description>
      <reference source="ssg" ref_id="package_samba_removed"/></metadata>
      <criteria>
        <criterion comment="package samba is removed" test_ref="oval:ssg-test_package_samba_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_smartmontools_removed:def:1" version="1">
      <metadata>
        <title>Package smartmontools Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package smartmontools should be removed.</description>
      <reference source="ssg" ref_id="package_smartmontools_removed"/></metadata>
      <criteria>
        <criterion comment="package smartmontools is removed" test_ref="oval:ssg-test_package_smartmontools_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_squid_removed:def:1" version="1">
      <metadata>
        <title>Package squid Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package squid should be removed.</description>
      <reference source="ssg" ref_id="package_squid_removed"/></metadata>
      <criteria>
        <criterion comment="package squid is removed" test_ref="oval:ssg-test_package_squid_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_sssd_installed:def:1" version="1">
      <metadata>
        <title>Package sssd Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package sssd should be installed.</description>
      <reference source="ssg" ref_id="package_sssd_installed"/></metadata>
      <criteria>
        <criterion comment="package sssd is installed" test_ref="oval:ssg-test_package_sssd_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_sssd_removed:def:1" version="1">
      <metadata>
        <title>Package sssd Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package sssd should be removed.</description>
      <reference source="ssg" ref_id="package_sssd_removed"/></metadata>
      <criteria>
        <criterion comment="package sssd is removed" test_ref="oval:ssg-test_package_sssd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_subscription-manager_removed:def:1" version="1">
      <metadata>
        <title>Package subscription-manager Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package subscription-manager should be removed.</description>
      <reference source="ssg" ref_id="package_subscription-manager_removed"/></metadata>
      <criteria>
        <criterion comment="package subscription-manager is removed" test_ref="oval:ssg-test_package_subscription-manager_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_sysstat_removed:def:1" version="1">
      <metadata>
        <title>Package sysstat Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package sysstat should be removed.</description>
      <reference source="ssg" ref_id="package_sysstat_removed"/></metadata>
      <criteria>
        <criterion comment="package sysstat is removed" test_ref="oval:ssg-test_package_sysstat_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_tcp_wrappers_installed:def:1" version="1">
      <metadata>
        <title>Package tcp_wrappers Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package tcp_wrappers should be installed.</description>
      <reference source="ssg" ref_id="package_tcp_wrappers_installed"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="xinetd package installed" definition_ref="oval:ssg-package_xinetd_installed:def:1"/>
        <criterion comment="package tcp_wrappers is installed" test_ref="oval:ssg-test_package_tcp_wrappers_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_tftp-server_removed:def:1" version="1">
      <metadata>
        <title>Package tftp-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package tftp-server should be removed.</description>
      <reference source="ssg" ref_id="package_tftp-server_removed"/></metadata>
      <criteria>
        <criterion comment="package tftp-server is removed" test_ref="oval:ssg-test_package_tftp-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_vsftpd_removed:def:1" version="1">
      <metadata>
        <title>Package vsftpd Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package vsftpd should be removed.</description>
      <reference source="ssg" ref_id="package_vsftpd_removed"/></metadata>
      <criteria>
        <criterion comment="package vsftpd is removed" test_ref="oval:ssg-test_package_vsftpd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_xinetd_installed:def:1" version="1">
      <metadata>
        <title>Package xinetd Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package xinetd should be installed.</description>
      <reference source="ssg" ref_id="package_xinetd_installed"/></metadata>
      <criteria>
        <criterion comment="package xinetd is installed" test_ref="oval:ssg-test_package_xinetd_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_xinetd_removed:def:1" version="1">
      <metadata>
        <title>Package xinetd Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package xinetd should be removed.</description>
      <reference source="ssg" ref_id="package_xinetd_removed"/></metadata>
      <criteria>
        <criterion comment="package xinetd is removed" test_ref="oval:ssg-test_package_xinetd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ypbind_removed:def:1" version="1">
      <metadata>
        <title>Package ypbind Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package ypbind should be removed.</description>
      <reference source="ssg" ref_id="package_ypbind_removed"/></metadata>
      <criteria>
        <criterion comment="package ypbind is removed" test_ref="oval:ssg-test_package_ypbind_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-pcscd_activation_socket_enabled:def:1" version="2">
      <metadata>
        <title>pcscd.socket Activation Socket Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The pcscd.socket activation socket should be enabled if possible.</description>
      <reference source="ssg" ref_id="pcscd_activation_socket_enabled"/></metadata>
      <criteria comment="package pcsc-lite installed and pcscd.socket activation socket is configured to start" operator="AND">
        <extend_definition comment="pcsc-lite installed" definition_ref="oval:ssg-package_pcsc-lite_installed:def:1"/>
        <criteria operator="OR" comment="pcscd.socket activation socket is configured to start">
          <criterion comment="multi-user.target wants pcscd.socket" test_ref="oval:ssg-test_multi_user_wants_pcscd.socket:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_abrtd_disabled:def:1" version="1">
      <metadata>
        <title>Service abrtd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The abrtd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_abrtd_disabled"/></metadata>
      <criteria comment="package abrt removed or service abrtd is not configured to start" operator="OR">
        <extend_definition comment="abrt removed" definition_ref="oval:ssg-package_abrt_removed:def:1"/>
        <criteria operator="OR" comment="service abrtd is not configured to start">
          <criterion comment="abrtd not wanted by multi-user.target" test_ref="oval:ssg-test_abrtd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_acpid_disabled:def:1" version="1">
      <metadata>
        <title>Service acpid Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The acpid service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_acpid_disabled"/></metadata>
      <criteria comment="package acpid removed or service acpid is not configured to start" operator="OR">
        <extend_definition comment="acpid removed" definition_ref="oval:ssg-package_acpid_removed:def:1"/>
        <criteria operator="OR" comment="service acpid is not configured to start">
          <criterion comment="acpid not wanted by multi-user.target" test_ref="oval:ssg-test_acpid_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_atd_disabled:def:1" version="1">
      <metadata>
        <title>Service atd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The atd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_atd_disabled"/></metadata>
      <criteria comment="package at removed or service atd is not configured to start" operator="OR">
        <extend_definition comment="at removed" definition_ref="oval:ssg-package_at_removed:def:1"/>
        <criteria operator="OR" comment="service atd is not configured to start">
          <criterion comment="atd not wanted by multi-user.target" test_ref="oval:ssg-test_atd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_auditd_enabled:def:1" version="1">
      <metadata>
        <title>Service auditd Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The auditd service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_auditd_enabled"/></metadata>
      <criteria comment="package audit installed and service auditd is configured to start" operator="AND">
        <extend_definition comment="audit installed" definition_ref="oval:ssg-package_audit_installed:def:1"/>
        <criteria operator="OR" comment="service auditd is configured to start">
          <criterion comment="multi-user.target wants auditd" test_ref="oval:ssg-test_multi_user_wants_auditd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_autofs_disabled:def:1" version="1">
      <metadata>
        <title>Service autofs Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The autofs service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_autofs_disabled"/></metadata>
      <criteria comment="package autofs removed or service autofs is not configured to start" operator="OR">
        <extend_definition comment="autofs removed" definition_ref="oval:ssg-package_autofs_removed:def:1"/>
        <criteria operator="OR" comment="service autofs is not configured to start">
          <criterion comment="autofs not wanted by multi-user.target" test_ref="oval:ssg-test_autofs_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_avahi-daemon_disabled:def:1" version="1">
      <metadata>
        <title>Service avahi-daemon Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The avahi-daemon service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_avahi-daemon_disabled"/></metadata>
      <criteria comment="package avahi removed or service avahi-daemon is not configured to start" operator="OR">
        <extend_definition comment="avahi removed" definition_ref="oval:ssg-package_avahi_removed:def:1"/>
        <criteria operator="OR" comment="service avahi-daemon is not configured to start">
          <criterion comment="avahi-daemon not wanted by multi-user.target" test_ref="oval:ssg-test_avahi-daemon_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_bluetooth_disabled:def:1" version="1">
      <metadata>
        <title>Service bluetooth Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The bluetooth service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_bluetooth_disabled"/></metadata>
      <criteria comment="package bluez removed or service bluetooth is not configured to start" operator="OR">
        <extend_definition comment="bluez removed" definition_ref="oval:ssg-package_bluez_removed:def:1"/>
        <criteria operator="OR" comment="service bluetooth is not configured to start">
          <criterion comment="bluetooth not wanted by multi-user.target" test_ref="oval:ssg-test_bluetooth_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_certmonger_disabled:def:1" version="1">
      <metadata>
        <title>Service certmonger Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The certmonger service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_certmonger_disabled"/></metadata>
      <criteria comment="package certmonger removed or service certmonger is not configured to start" operator="OR">
        <extend_definition comment="certmonger removed" definition_ref="oval:ssg-package_certmonger_removed:def:1"/>
        <criteria operator="OR" comment="service certmonger is not configured to start">
          <criterion comment="certmonger not wanted by multi-user.target" test_ref="oval:ssg-test_certmonger_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_cgconfig_disabled:def:1" version="1">
      <metadata>
        <title>Service cgconfig Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The cgconfig service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_cgconfig_disabled"/></metadata>
      <criteria comment="package libcgroup removed or service cgconfig is not configured to start" operator="OR">
        <extend_definition comment="libcgroup removed" definition_ref="oval:ssg-package_libcgroup_removed:def:1"/>
        <criteria operator="OR" comment="service cgconfig is not configured to start">
          <criterion comment="cgconfig not wanted by multi-user.target" test_ref="oval:ssg-test_cgconfig_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_cgred_disabled:def:1" version="1">
      <metadata>
        <title>Service cgred Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The cgred service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_cgred_disabled"/></metadata>
      <criteria comment="package libcgroup-tools removed or service cgred is not configured to start" operator="OR">
        <extend_definition comment="libcgroup-tools removed" definition_ref="oval:ssg-package_libcgroup-tools_removed:def:1"/>
        <criteria operator="OR" comment="service cgred is not configured to start">
          <criterion comment="cgred not wanted by multi-user.target" test_ref="oval:ssg-test_cgred_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_chronyd_enabled:def:1" version="1">
      <metadata>
        <title>Service chronyd Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The chronyd service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_chronyd_enabled"/></metadata>
      <criteria comment="package chrony installed and service chronyd is configured to start" operator="AND">
        <extend_definition comment="chrony installed" definition_ref="oval:ssg-package_chrony_installed:def:1"/>
        <criteria operator="OR" comment="service chronyd is configured to start">
          <criterion comment="multi-user.target wants chronyd" test_ref="oval:ssg-test_multi_user_wants_chronyd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_chronyd_or_ntpd_enabled:def:1" version="1">
      <metadata>
        <title>Service chronyd Or Service ntpd Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>At least one of the chronyd or ntpd services should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_chronyd_or_ntpd_enabled"/></metadata>
      <criteria comment="chronyd or ntpd service enabled" operator="OR">
        <extend_definition comment="service chronyd enabled" definition_ref="oval:ssg-service_chronyd_enabled:def:1"/>
        <extend_definition comment="service ntpd enabled" definition_ref="oval:ssg-service_ntpd_enabled:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_cpupower_disabled:def:1" version="1">
      <metadata>
        <title>Service cpupower Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The cpupower service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_cpupower_disabled"/></metadata>
      <criteria comment="package kernel-tools removed or service cpupower is not configured to start" operator="OR">
        <extend_definition comment="kernel-tools removed" definition_ref="oval:ssg-package_kernel-tools_removed:def:1"/>
        <criteria operator="OR" comment="service cpupower is not configured to start">
          <criterion comment="cpupower not wanted by multi-user.target" test_ref="oval:ssg-test_cpupower_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_crond_enabled:def:1" version="1">
      <metadata>
        <title>Service crond Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The crond service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_crond_enabled"/></metadata>
      <criteria comment="package cronie installed and service crond is configured to start" operator="AND">
        <extend_definition comment="cronie installed" definition_ref="oval:ssg-package_cronie_installed:def:1"/>
        <criteria operator="OR" comment="service crond is configured to start">
          <criterion comment="multi-user.target wants crond" test_ref="oval:ssg-test_multi_user_wants_crond:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_cups_disabled:def:1" version="1">
      <metadata>
        <title>Service cups Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The cups service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_cups_disabled"/></metadata>
      <criteria comment="package cups removed or service cups is not configured to start" operator="OR">
        <extend_definition comment="cups removed" definition_ref="oval:ssg-package_cups_removed:def:1"/>
        <criteria operator="OR" comment="service cups is not configured to start">
          <criterion comment="cups not wanted by multi-user.target" test_ref="oval:ssg-test_cups_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_debug-shell_disabled:def:1" version="1">
      <metadata>
        <title>Service debug-shell Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The debug-shell service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_debug-shell_disabled"/></metadata>
      <criteria comment="package debug-shell removed or service debug-shell is not configured to start" operator="AND">
        <criterion comment="debug-shell not wanted by multi-user.target" test_ref="oval:ssg-test_debug-shell_not_wanted_by_multi_user_target:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_dhcpd_disabled:def:1" version="1">
      <metadata>
        <title>Service dhcpd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The dhcpd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_dhcpd_disabled"/></metadata>
      <criteria comment="package dhcp removed or service dhcpd is not configured to start" operator="OR">
        <extend_definition comment="dhcp removed" definition_ref="oval:ssg-package_dhcp_removed:def:1"/>
        <criteria operator="OR" comment="service dhcpd is not configured to start">
          <criterion comment="dhcpd not wanted by multi-user.target" test_ref="oval:ssg-test_dhcpd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_docker_enabled:def:1" version="1">
      <metadata>
        <title>Service docker Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The docker service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_docker_enabled"/></metadata>
      <criteria comment="package docker installed and service docker is configured to start" operator="AND">
        <extend_definition comment="docker installed" definition_ref="oval:ssg-package_docker_installed:def:1"/>
        <criteria operator="OR" comment="service docker is configured to start">
          <criterion comment="multi-user.target wants docker" test_ref="oval:ssg-test_multi_user_wants_docker:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_dovecot_disabled:def:1" version="1">
      <metadata>
        <title>Service dovecot Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The dovecot service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_dovecot_disabled"/></metadata>
      <criteria comment="package dovecot removed or service dovecot is not configured to start" operator="OR">
        <extend_definition comment="dovecot removed" definition_ref="oval:ssg-package_dovecot_removed:def:1"/>
        <criteria operator="OR" comment="service dovecot is not configured to start">
          <criterion comment="dovecot not wanted by multi-user.target" test_ref="oval:ssg-test_dovecot_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_firewalld_enabled:def:1" version="1">
      <metadata>
        <title>Service firewalld Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The firewalld service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_firewalld_enabled"/></metadata>
      <criteria comment="package firewalld installed and service firewalld is configured to start" operator="AND">
        <extend_definition comment="firewalld installed" definition_ref="oval:ssg-package_firewalld_installed:def:1"/>
        <criteria operator="OR" comment="service firewalld is configured to start">
          <criterion comment="multi-user.target wants firewalld" test_ref="oval:ssg-test_multi_user_wants_firewalld:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_httpd_disabled:def:1" version="1">
      <metadata>
        <title>Service httpd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The httpd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_httpd_disabled"/></metadata>
      <criteria comment="package httpd removed or service httpd is not configured to start" operator="OR">
        <extend_definition comment="httpd removed" definition_ref="oval:ssg-package_httpd_removed:def:1"/>
        <criteria operator="OR" comment="service httpd is not configured to start">
          <criterion comment="httpd not wanted by multi-user.target" test_ref="oval:ssg-test_httpd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_irqbalance_enabled:def:1" version="1">
      <metadata>
        <title>Service irqbalance Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The irqbalance service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_irqbalance_enabled"/></metadata>
      <criteria comment="package irqbalance installed and service irqbalance is configured to start" operator="AND">
        <extend_definition comment="irqbalance installed" definition_ref="oval:ssg-package_irqbalance_installed:def:1"/>
        <criteria operator="OR" comment="service irqbalance is configured to start">
          <criterion comment="multi-user.target wants irqbalance" test_ref="oval:ssg-test_multi_user_wants_irqbalance:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_kdump_disabled:def:1" version="1">
      <metadata>
        <title>Service kdump Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kdump service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_kdump_disabled"/></metadata>
      <criteria comment="package kexec-tools removed or service kdump is not configured to start" operator="OR">
        <extend_definition comment="kexec-tools removed" definition_ref="oval:ssg-package_kexec-tools_removed:def:1"/>
        <criteria operator="OR" comment="service kdump is not configured to start">
          <criterion comment="kdump not wanted by multi-user.target" test_ref="oval:ssg-test_kdump_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_mdmonitor_disabled:def:1" version="1">
      <metadata>
        <title>Service mdmonitor Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The mdmonitor service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_mdmonitor_disabled"/></metadata>
      <criteria comment="package mdadm removed or service mdmonitor is not configured to start" operator="OR">
        <extend_definition comment="mdadm removed" definition_ref="oval:ssg-package_mdadm_removed:def:1"/>
        <criteria operator="OR" comment="service mdmonitor is not configured to start">
          <criterion comment="mdmonitor not wanted by multi-user.target" test_ref="oval:ssg-test_mdmonitor_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_messagebus_disabled:def:1" version="1">
      <metadata>
        <title>Service messagebus Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The messagebus service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_messagebus_disabled"/></metadata>
      <criteria comment="package dbus removed or service messagebus is not configured to start" operator="OR">
        <extend_definition comment="dbus removed" definition_ref="oval:ssg-package_dbus_removed:def:1"/>
        <criteria operator="OR" comment="service messagebus is not configured to start">
          <criterion comment="messagebus not wanted by multi-user.target" test_ref="oval:ssg-test_messagebus_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_named_disabled:def:1" version="1">
      <metadata>
        <title>Service named Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The named service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_named_disabled"/></metadata>
      <criteria comment="package bind removed or service named is not configured to start" operator="OR">
        <extend_definition comment="bind removed" definition_ref="oval:ssg-package_bind_removed:def:1"/>
        <criteria operator="OR" comment="service named is not configured to start">
          <criterion comment="named not wanted by multi-user.target" test_ref="oval:ssg-test_named_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_netconsole_disabled:def:1" version="1">
      <metadata>
        <title>Service netconsole Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The netconsole service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_netconsole_disabled"/></metadata>
      <criteria operator="OR" comment="service netconsole is not configured to start">
        <criterion comment="netconsole not wanted by multi-user.target" test_ref="oval:ssg-test_netconsole_not_wanted_by_multi_user_target:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_nfs_disabled:def:1" version="1">
      <metadata>
        <title>Service nfs Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The nfs service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_nfs_disabled"/></metadata>
      <criteria comment="package nfs-utils removed or service nfs is not configured to start" operator="OR">
        <extend_definition comment="nfs-utils removed" definition_ref="oval:ssg-package_nfs-utils_removed:def:1"/>
        <criteria operator="OR" comment="service nfs is not configured to start">
          <criterion comment="nfs not wanted by multi-user.target" test_ref="oval:ssg-test_nfs_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_nfslock_disabled:def:1" version="1">
      <metadata>
        <title>Service nfslock Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The nfslock service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_nfslock_disabled"/></metadata>
      <criteria comment="package nfs-utils removed or service nfslock is not configured to start" operator="OR">
        <extend_definition comment="nfs-utils removed" definition_ref="oval:ssg-package_nfs-utils_removed:def:1"/>
        <criteria operator="OR" comment="service nfslock is not configured to start">
          <criterion comment="nfslock not wanted by multi-user.target" test_ref="oval:ssg-test_nfslock_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_ntpd_enabled:def:1" version="1">
      <metadata>
        <title>Service ntpd Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The ntpd service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_ntpd_enabled"/></metadata>
      <criteria comment="package ntp installed and service ntpd is configured to start" operator="AND">
        <extend_definition comment="ntp installed" definition_ref="oval:ssg-package_ntp_installed:def:1"/>
        <criteria operator="OR" comment="service ntpd is configured to start">
          <criterion comment="multi-user.target wants ntpd" test_ref="oval:ssg-test_multi_user_wants_ntpd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_ntpdate_disabled:def:1" version="1">
      <metadata>
        <title>Service ntpdate Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The ntpdate service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_ntpdate_disabled"/></metadata>
      <criteria comment="package ntpdate removed or service ntpdate is not configured to start" operator="OR">
        <extend_definition comment="ntpdate removed" definition_ref="oval:ssg-package_ntpdate_removed:def:1"/>
        <criteria operator="OR" comment="service ntpdate is not configured to start">
          <criterion comment="ntpdate not wanted by multi-user.target" test_ref="oval:ssg-test_ntpdate_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_oddjobd_disabled:def:1" version="1">
      <metadata>
        <title>Service oddjobd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The oddjobd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_oddjobd_disabled"/></metadata>
      <criteria comment="package oddjob removed or service oddjobd is not configured to start" operator="OR">
        <extend_definition comment="oddjob removed" definition_ref="oval:ssg-package_oddjob_removed:def:1"/>
        <criteria operator="OR" comment="service oddjobd is not configured to start">
          <criterion comment="oddjobd not wanted by multi-user.target" test_ref="oval:ssg-test_oddjobd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_portreserve_disabled:def:1" version="1">
      <metadata>
        <title>Service portreserve Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The portreserve service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_portreserve_disabled"/></metadata>
      <criteria comment="package portreserve removed or service portreserve is not configured to start" operator="OR">
        <extend_definition comment="portreserve removed" definition_ref="oval:ssg-package_portreserve_removed:def:1"/>
        <criteria operator="OR" comment="service portreserve is not configured to start">
          <criterion comment="portreserve not wanted by multi-user.target" test_ref="oval:ssg-test_portreserve_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_postfix_enabled:def:1" version="1">
      <metadata>
        <title>Service postfix Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The postfix service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_postfix_enabled"/></metadata>
      <criteria comment="package postfix installed and service postfix is configured to start" operator="AND">
        <extend_definition comment="postfix installed" definition_ref="oval:ssg-package_postfix_installed:def:1"/>
        <criteria operator="OR" comment="service postfix is configured to start">
          <criterion comment="multi-user.target wants postfix" test_ref="oval:ssg-test_multi_user_wants_postfix:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_psacct_enabled:def:1" version="1">
      <metadata>
        <title>Service psacct Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The psacct service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_psacct_enabled"/></metadata>
      <criteria comment="package psacct installed and service psacct is configured to start" operator="AND">
        <extend_definition comment="psacct installed" definition_ref="oval:ssg-package_psacct_installed:def:1"/>
        <criteria operator="OR" comment="service psacct is configured to start">
          <criterion comment="multi-user.target wants psacct" test_ref="oval:ssg-test_multi_user_wants_psacct:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_qpidd_disabled:def:1" version="1">
      <metadata>
        <title>Service qpidd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The qpidd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_qpidd_disabled"/></metadata>
      <criteria comment="package qpid-cpp-server removed or service qpidd is not configured to start" operator="OR">
        <extend_definition comment="qpid-cpp-server removed" definition_ref="oval:ssg-package_qpid-cpp-server_removed:def:1"/>
        <criteria operator="OR" comment="service qpidd is not configured to start">
          <criterion comment="qpidd not wanted by multi-user.target" test_ref="oval:ssg-test_qpidd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_quota_nld_disabled:def:1" version="1">
      <metadata>
        <title>Service quota_nld Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The quota_nld service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_quota_nld_disabled"/></metadata>
      <criteria comment="package quota-nld removed or service quota_nld is not configured to start" operator="OR">
        <extend_definition comment="quota-nld removed" definition_ref="oval:ssg-package_quota-nld_removed:def:1"/>
        <criteria operator="OR" comment="service quota_nld is not configured to start">
          <criterion comment="quota_nld not wanted by multi-user.target" test_ref="oval:ssg-test_quota_nld_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rdisc_disabled:def:1" version="1">
      <metadata>
        <title>Service rdisc Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The rdisc service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_rdisc_disabled"/></metadata>
      <criteria comment="package iputils removed or service rdisc is not configured to start" operator="OR">
        <extend_definition comment="iputils removed" definition_ref="oval:ssg-package_iputils_removed:def:1"/>
        <criteria operator="OR" comment="service rdisc is not configured to start">
          <criterion comment="rdisc not wanted by multi-user.target" test_ref="oval:ssg-test_rdisc_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rexec_disabled:def:1" version="1">
      <metadata>
        <title>Service rexec Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The rexec service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_rexec_disabled"/></metadata>
      <criteria comment="package rsh-server removed or socket rexec is not configured to start" operator="OR">
        <extend_definition comment="rsh-server removed" definition_ref="oval:ssg-package_rsh-server_removed:def:1"/>
        <criteria operator="AND" comment="socket rexec is not configured to start">
          <criterion comment="rexec not wanted by multi-user.target" test_ref="oval:ssg-test_rexec_not_wanted_by_multi_user_target:tst:1"/>
          <criterion comment="rexec disabled" test_ref="oval:ssg-test_etc_xinetd_rexec_disabled:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rhnsd_disabled:def:1" version="1">
      <metadata>
        <title>Service rhnsd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The rhnsd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_rhnsd_disabled"/></metadata>
      <criteria comment="package rhnsd removed or service rhnsd is not configured to start" operator="OR">
        <extend_definition comment="rhnsd removed" definition_ref="oval:ssg-package_rhnsd_removed:def:1"/>
        <criteria operator="OR" comment="service rhnsd is not configured to start">
          <criterion comment="rhnsd not wanted by multi-user.target" test_ref="oval:ssg-test_rhnsd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rhsmcertd_disabled:def:1" version="1">
      <metadata>
        <title>Service rhsmcertd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The rhsmcertd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_rhsmcertd_disabled"/></metadata>
      <criteria comment="package subscription-manager removed or service rhsmcertd is not configured to start" operator="OR">
        <extend_definition comment="subscription-manager removed" definition_ref="oval:ssg-package_subscription-manager_removed:def:1"/>
        <criteria operator="OR" comment="service rhsmcertd is not configured to start">
          <criterion comment="rhsmcertd not wanted by multi-user.target" test_ref="oval:ssg-test_rhsmcertd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rlogin_disabled:def:1" version="1">
      <metadata>
        <title>Service rlogin Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The rlogin service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_rlogin_disabled"/></metadata>
      <criteria comment="package rsh-server removed or socket rlogin is not configured to start" operator="OR">
        <extend_definition comment="rsh-server removed" definition_ref="oval:ssg-package_rsh-server_removed:def:1"/>
        <criteria operator="AND" comment="socket rlogin is not configured to start">
          <criterion comment="rlogin not wanted by multi-user.target" test_ref="oval:ssg-test_rlogin_not_wanted_by_multi_user_target:tst:1"/>
          <criterion comment="rlogin disabled" test_ref="oval:ssg-test_etc_xinetd_rlogin_disabled:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rpcbind_disabled:def:1" version="1">
      <metadata>
        <title>Service rpcbind Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The rpcbind service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_rpcbind_disabled"/></metadata>
      <criteria comment="package nfs-utils removed or service rpcbind is not configured to start" operator="OR">
        <extend_definition comment="nfs-utils removed" definition_ref="oval:ssg-package_nfs-utils_removed:def:1"/>
        <criteria operator="OR" comment="service rpcbind is not configured to start">
          <criterion comment="rpcbind not wanted by multi-user.target" test_ref="oval:ssg-test_rpcbind_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rpcgssd_disabled:def:1" version="1">
      <metadata>
        <title>Service rpcgssd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The rpcgssd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_rpcgssd_disabled"/></metadata>
      <criteria comment="package nfs-utils removed or service rpcgssd is not configured to start" operator="OR">
        <extend_definition comment="nfs-utils removed" definition_ref="oval:ssg-package_nfs-utils_removed:def:1"/>
        <criteria operator="OR" comment="service rpcgssd is not configured to start">
          <criterion comment="rpcgssd not wanted by multi-user.target" test_ref="oval:ssg-test_rpcgssd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rpcidmapd_disabled:def:1" version="1">
      <metadata>
        <title>Service rpcidmapd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The rpcidmapd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_rpcidmapd_disabled"/></metadata>
      <criteria comment="package nfs-utils removed or service rpcidmapd is not configured to start" operator="OR">
        <extend_definition comment="nfs-utils removed" definition_ref="oval:ssg-package_nfs-utils_removed:def:1"/>
        <criteria operator="OR" comment="service rpcidmapd is not configured to start">
          <criterion comment="rpcidmapd not wanted by multi-user.target" test_ref="oval:ssg-test_rpcidmapd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rpcsvcgssd_disabled:def:1" version="1">
      <metadata>
        <title>Service rpcsvcgssd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The rpcsvcgssd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_rpcsvcgssd_disabled"/></metadata>
      <criteria comment="package nfs-utils removed or service rpcsvcgssd is not configured to start" operator="OR">
        <extend_definition comment="nfs-utils removed" definition_ref="oval:ssg-package_nfs-utils_removed:def:1"/>
        <criteria operator="OR" comment="service rpcsvcgssd is not configured to start">
          <criterion comment="rpcsvcgssd not wanted by multi-user.target" test_ref="oval:ssg-test_rpcsvcgssd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rsh_disabled:def:1" version="1">
      <metadata>
        <title>Service rsh Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The rsh service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_rsh_disabled"/></metadata>
      <criteria comment="package rsh-server removed or socket rsh is not configured to start" operator="OR">
        <extend_definition comment="rsh-server removed" definition_ref="oval:ssg-package_rsh-server_removed:def:1"/>
        <criteria operator="AND" comment="socket rsh is not configured to start">
          <criterion comment="rsh not wanted by multi-user.target" test_ref="oval:ssg-test_rsh_not_wanted_by_multi_user_target:tst:1"/>
          <criterion comment="rsh disabled" test_ref="oval:ssg-test_etc_xinetd_rsh_disabled:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_rsyslog_enabled:def:1" version="1">
      <metadata>
        <title>Service rsyslog Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The rsyslog service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_rsyslog_enabled"/></metadata>
      <criteria comment="package rsyslog installed and service rsyslog is configured to start" operator="AND">
        <extend_definition comment="rsyslog installed" definition_ref="oval:ssg-package_rsyslog_installed:def:1"/>
        <criteria operator="OR" comment="service rsyslog is configured to start">
          <criterion comment="multi-user.target wants rsyslog" test_ref="oval:ssg-test_multi_user_wants_rsyslog:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_saslauthd_disabled:def:1" version="1">
      <metadata>
        <title>Service saslauthd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The saslauthd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_saslauthd_disabled"/></metadata>
      <criteria comment="package cyrus-sasl removed or service saslauthd is not configured to start" operator="OR">
        <extend_definition comment="cyrus-sasl removed" definition_ref="oval:ssg-package_cyrus-sasl_removed:def:1"/>
        <criteria operator="OR" comment="service saslauthd is not configured to start">
          <criterion comment="saslauthd not wanted by multi-user.target" test_ref="oval:ssg-test_saslauthd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_smartd_disabled:def:1" version="1">
      <metadata>
        <title>Service smartd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The smartd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_smartd_disabled"/></metadata>
      <criteria comment="package smartmontools removed or service smartd is not configured to start" operator="OR">
        <extend_definition comment="smartmontools removed" definition_ref="oval:ssg-package_smartmontools_removed:def:1"/>
        <criteria operator="OR" comment="service smartd is not configured to start">
          <criterion comment="smartd not wanted by multi-user.target" test_ref="oval:ssg-test_smartd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_smb_disabled:def:1" version="1">
      <metadata>
        <title>Service smb Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The smb service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_smb_disabled"/></metadata>
      <criteria comment="package samba removed or service smb is not configured to start" operator="OR">
        <extend_definition comment="samba removed" definition_ref="oval:ssg-package_samba_removed:def:1"/>
        <criteria operator="OR" comment="service smb is not configured to start">
          <criterion comment="smb not wanted by multi-user.target" test_ref="oval:ssg-test_smb_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_snmpd_disabled:def:1" version="1">
      <metadata>
        <title>Service snmpd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The snmpd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_snmpd_disabled"/></metadata>
      <criteria comment="package net-snmp removed or service snmpd is not configured to start" operator="OR">
        <extend_definition comment="net-snmp removed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
        <criteria operator="OR" comment="service snmpd is not configured to start">
          <criterion comment="snmpd not wanted by multi-user.target" test_ref="oval:ssg-test_snmpd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_squid_disabled:def:1" version="1">
      <metadata>
        <title>Service squid Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The squid service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_squid_disabled"/></metadata>
      <criteria comment="package squid removed or service squid is not configured to start" operator="OR">
        <extend_definition comment="squid removed" definition_ref="oval:ssg-package_squid_removed:def:1"/>
        <criteria operator="OR" comment="service squid is not configured to start">
          <criterion comment="squid not wanted by multi-user.target" test_ref="oval:ssg-test_squid_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_sshd_disabled:def:1" version="2">
      <metadata>
        <title>Service sshd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The sshd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_sshd_disabled"/></metadata>
      <criteria>
        <extend_definition definition_ref="oval:ssg-service_sshd_enabled:def:1" negate="true" comment="Package openssh-server removed or service sshd not configured to start"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_sshd_enabled:def:1" version="1">
      <metadata>
        <title>Service sshd Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The sshd service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_sshd_enabled"/></metadata>
      <criteria comment="package openssh-server installed and service sshd is configured to start" operator="AND">
        <extend_definition comment="openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
        <criteria operator="OR" comment="service sshd is configured to start">
          <criterion comment="multi-user.target wants sshd" test_ref="oval:ssg-test_multi_user_wants_sshd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_sssd_disabled:def:1" version="1">
      <metadata>
        <title>Service sssd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The sssd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_sssd_disabled"/></metadata>
      <criteria comment="package sssd removed or service sssd is not configured to start" operator="OR">
        <extend_definition comment="sssd removed" definition_ref="oval:ssg-package_sssd_removed:def:1"/>
        <criteria operator="OR" comment="service sssd is not configured to start">
          <criterion comment="sssd not wanted by multi-user.target" test_ref="oval:ssg-test_sssd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_sssd_enabled:def:1" version="1">
      <metadata>
        <title>Service sssd Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The sssd service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_sssd_enabled"/></metadata>
      <criteria comment="package sssd installed and service sssd is configured to start" operator="AND">
        <extend_definition comment="sssd installed" definition_ref="oval:ssg-package_sssd_installed:def:1"/>
        <criteria operator="OR" comment="service sssd is configured to start">
          <criterion comment="multi-user.target wants sssd" test_ref="oval:ssg-test_multi_user_wants_sssd:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_sysstat_disabled:def:1" version="1">
      <metadata>
        <title>Service sysstat Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The sysstat service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_sysstat_disabled"/></metadata>
      <criteria comment="package sysstat removed or service sysstat is not configured to start" operator="OR">
        <extend_definition comment="sysstat removed" definition_ref="oval:ssg-package_sysstat_removed:def:1"/>
        <criteria operator="OR" comment="service sysstat is not configured to start">
          <criterion comment="sysstat not wanted by multi-user.target" test_ref="oval:ssg-test_sysstat_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_telnet_disabled:def:1" version="1">
      <metadata>
        <title>Service telnet Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The telnet service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_telnet_disabled"/></metadata>
      <criteria comment="package telnet-server removed or socket telnet is not configured to start" operator="OR">
        <extend_definition comment="telnet-server removed" definition_ref="oval:ssg-package_telnet-server_removed:def:1"/>
        <criteria operator="AND" comment="socket telnet is not configured to start">
          <criterion comment="telnet not wanted by multi-user.target" test_ref="oval:ssg-test_telnet_not_wanted_by_multi_user_target:tst:1"/>
          <criterion comment="Disable telnet xinetd" test_ref="oval:ssg-test_xinetd_telnetd_disabled:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_tftp_disabled:def:1" version="1">
      <metadata>
        <title>Service tftp Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The tftp service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_tftp_disabled"/></metadata>
      <criteria comment="package tftp-server removed or service tftp is not configured to start" operator="OR">
        <extend_definition comment="tftp-server removed" definition_ref="oval:ssg-package_tftp-server_removed:def:1"/>
        <criteria operator="OR" comment="service tftp is not configured to start">
          <criterion comment="tftp not wanted by multi-user.target" test_ref="oval:ssg-test_tftp_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_vsftpd_disabled:def:1" version="1">
      <metadata>
        <title>Service vsftpd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The vsftpd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_vsftpd_disabled"/></metadata>
      <criteria comment="package vsftpd removed or service vsftpd is not configured to start" operator="OR">
        <extend_definition comment="vsftpd removed" definition_ref="oval:ssg-package_vsftpd_removed:def:1"/>
        <criteria operator="OR" comment="service vsftpd is not configured to start">
          <criterion comment="vsftpd not wanted by multi-user.target" test_ref="oval:ssg-test_vsftpd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_xinetd_disabled:def:1" version="1">
      <metadata>
        <title>Service xinetd Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The xinetd service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_xinetd_disabled"/></metadata>
      <criteria comment="package xinetd removed or service xinetd is not configured to start" operator="OR">
        <extend_definition comment="xinetd removed" definition_ref="oval:ssg-package_xinetd_removed:def:1"/>
        <criteria operator="OR" comment="service xinetd is not configured to start">
          <criterion comment="xinetd not wanted by multi-user.target" test_ref="oval:ssg-test_xinetd_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_ypbind_disabled:def:1" version="1">
      <metadata>
        <title>Service ypbind Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The ypbind service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_ypbind_disabled"/></metadata>
      <criteria comment="package ypbind removed or service ypbind is not configured to start" operator="OR">
        <extend_definition comment="ypbind removed" definition_ref="oval:ssg-package_ypbind_removed:def:1"/>
        <criteria operator="OR" comment="service ypbind is not configured to start">
          <criterion comment="ypbind not wanted by multi-user.target" test_ref="oval:ssg-test_ypbind_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_zebra_disabled:def:1" version="1">
      <metadata>
        <title>Service zebra Disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The zebra service should be disabled if possible.</description>
      <reference source="ssg" ref_id="service_zebra_disabled"/></metadata>
      <criteria comment="package quagga removed or service zebra is not configured to start" operator="OR">
        <extend_definition comment="quagga removed" definition_ref="oval:ssg-package_quagga_removed:def:1"/>
        <criteria operator="OR" comment="service zebra is not configured to start">
          <criterion comment="zebra not wanted by multi-user.target" test_ref="oval:ssg-test_zebra_not_wanted_by_multi_user_target:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-smartcard_auth:def:1" version="2">
      <metadata>
        <title>Enable Smart Card Login</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Enable Smart Card logins</description>
      <reference source="ssg" ref_id="smartcard_auth"/></metadata>
      <criteria comment="smart card authentication is configured" operator="AND">
        <extend_definition comment="pam_pkcs11 package is installed" definition_ref="oval:ssg-package_pam_pkcs11_installed:def:1"/>
        <extend_definition comment="esc package is installed" definition_ref="oval:ssg-package_esc_installed:def:1"/>
        <extend_definition comment="pcscd service is enabled" definition_ref="oval:ssg-pcscd_activation_socket_enabled:def:1"/>
        <criterion comment="cert_policy directive contains oscp_on" test_ref="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1"/>
        <criteria comment="smart card authentication is enabled or required in system-auth" operator="OR">
          <!-- Smartcard authentication enabled, but login is allowed also by other means -->
          <criterion comment="smart card authentication is enabled in /etc/pam.d/system-auth" test_ref="oval:ssg-test_smart_card_enabled_system_auth:tst:1"/>
          <!-- Smartcard authentication required (login is allowed only via smartcard) -->
          <criterion comment="smart card is required in /etc/pam.d/system-auth" test_ref="oval:ssg-test_smart_card_required_system_auth:tst:1"/>
        </criteria>
        <criterion comment="smart card is required in /etc/pam.d/smartcard-auth" test_ref="oval:ssg-test_smart_card_required_smartcard_auth:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sssd_conf_exists:def:1" version="1">
      <metadata>
        <title>Verify The SSSD Configuration File Exists</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The /etc/sssd/sssd.conf file should exist if it is
      in use.</description>
      <reference source="ssg" ref_id="sssd_conf_exists"/></metadata>
      <criteria>
        <criterion comment="Check if sssd_conf_exists" test_ref="oval:ssg-test_sssd_conf_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sssd_memcache_timeout:def:1" version="1">
      <metadata>
        <title>Configure SSSD's Memory Cache to Expire</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>SSSD's memory cache should be configured to set to expire records after 1 day.</description>
      <reference source="ssg" ref_id="sssd_memcache_timeout"/></metadata>
      <criteria operator="OR">
        <criteria operator="OR">
          <extend_definition comment="Check if sssd service is disabled" definition_ref="oval:ssg-service_sssd_disabled:def:1"/>
          <extend_definition comment="Check if /etc/sssd/sssd.conf is configured for usage" definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true"/>
        </criteria>
        <criterion comment="Check memcache_timeout in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_memcache_timeout:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sssd_offline_cred_expiration:def:1" version="1">
      <metadata>
        <title>Configure SSSD to Expire Offline Credentials</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>SSSD should be configured to expire offline credentials after 1 day.</description>
      <reference source="ssg" ref_id="sssd_offline_cred_expiration"/></metadata>
      <criteria operator="OR">
        <criteria operator="OR">
          <extend_definition comment="Check if sssd service is disabled" definition_ref="oval:ssg-service_sssd_disabled:def:1"/>
          <extend_definition comment="Check if /etc/sssd/sssd.conf is configured for usage" definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true"/>
        </criteria>
        <criterion comment="Check offline_credentials_expiration in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_offline_cred_expiration:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sssd_ssh_known_hosts_timeout:def:1" version="1">
      <metadata>
        <title>Configure SSSD to Expire SSH Known Hosts</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>SSSD should be configured to expire keys from known SSH hosts after 1 day.</description>
      <reference source="ssg" ref_id="sssd_ssh_known_hosts_timeout"/></metadata>
      <criteria operator="OR">
        <criteria operator="OR">
          <extend_definition comment="Check if sssd service is disabled" definition_ref="oval:ssg-service_sssd_disabled:def:1"/>
          <extend_definition comment="Check if /etc/sssd/sssd.conf is configured for usage" definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true"/>
        </criteria>
        <criterion comment="Check ssh_known_hosts_timeout in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-chronyd_specify_multiple_servers:def:1" version="1">
      <metadata>
        <title>Specify Multiple Remote chronyd NTP Servers for Time Data</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Multiple chronyd NTP Servers for time synchronization should be specified.</description>
      <reference source="ssg" ref_id="chronyd_specify_multiple_servers"/></metadata>
      <criteria comment="chrony.conf conditions are met">
        <criterion test_ref="oval:ssg-test_chronyd_multiple_servers:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-chronyd_specify_remote_server:def:1" version="1">
      <metadata>
        <title>Specify a Remote NTP Server for Time Data</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>A remote NTP Server for time synchronization should be
      specified (and dependencies are met)</description>
      <reference source="ssg" ref_id="chronyd_specify_remote_server"/></metadata>
      <criteria comment="chrony.conf conditions are met">
        <criterion test_ref="oval:ssg-test_chronyd_remote_server:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-disable_ctrlaltdel_reboot:def:1" version="1">
      <metadata>
        <title>Disable Ctrl-Alt-Del Reboot Activation</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>By default, the system will reboot when the
      Ctrl-Alt-Del key sequence is pressed.</description>
      <reference source="ssg" ref_id="disable_ctrlaltdel_reboot"/></metadata>
      <criteria>
        <criterion comment="Disable Ctrl-Alt-Del systemd softlink exists" test_ref="oval:ssg-test_disable_ctrlaltdel_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dovecot_disable_plaintext_auth:def:1" version="1">
      <metadata>
        <title>Disable Plaintext Authentication in Dovecot</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Plaintext authentication of mail clients should be disabled.</description>
      <reference source="ssg" ref_id="dovecot_disable_plaintext_auth"/></metadata>
      <criteria comment="Disable Plaintext Authentication in Dovecot" operator="OR">
        <extend_definition comment="dovecot service is disabled" definition_ref="oval:ssg-service_dovecot_disabled:def:1"/>
        <criterion test_ref="oval:ssg-test_dovecot_disable_plaintext_auth:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dovecot_enable_ssl:def:1" version="1">
      <metadata>
        <title>Enable SSL in Dovecot</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>SSL capabilities should be enabled for the mail server.</description>
      <reference source="ssg" ref_id="dovecot_enable_ssl"/></metadata>
      <criteria comment="Enable SSL in Dovecot" operator="OR">
        <extend_definition comment="dovecot service is disabled" definition_ref="oval:ssg-service_dovecot_disabled:def:1"/>
        <criterion test_ref="oval:ssg-test_dovecot_enable_ssl:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ntpd_specify_multiple_servers:def:1" version="2">
      <metadata>
        <title>Specify Multiple Remote ntpd NTP Server for Time Data</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Multiple ntpd NTP Servers for time synchronization should be specified.</description>
      <reference source="ssg" ref_id="ntpd_specify_multiple_servers"/></metadata>
      <criteria comment="ntp.conf conditions are met">
        <criterion test_ref="oval:ssg-test_ntpd_multiple_servers:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ntpd_specify_remote_server:def:1" version="2">
      <metadata>
        <title>Specify a Remote ntpd NTP Server for Time Data</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>A remote ntpd NTP Server for time synchronization should be
      specified (and dependencies are met)</description>
      <reference source="ssg" ref_id="ntpd_specify_remote_server"/></metadata>
      <criteria comment="ntp.conf conditions are met">
        <criterion test_ref="oval:ssg-test_ntp_remote_server:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_audit_installed:def:1" version="1">
      <metadata>
        <title>Package audit Installed</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package audit should be installed.</description>
      <reference source="ssg" ref_id="package_audit_installed"/></metadata>
      <criteria>
        <criterion comment="package audit is installed" test_ref="oval:ssg-test_package_audit_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_chrony_installed:def:1" version="1">
      <metadata>
        <title>Package chrony Installed</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package chrony should be installed.</description>
      <reference source="ssg" ref_id="package_chrony_installed"/></metadata>
      <criteria>
        <criterion comment="package chrony is installed" test_ref="oval:ssg-test_package_chrony_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_cronie_installed:def:1" version="1">
      <metadata>
        <title>Package cronie Installed</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package cronie should be installed.</description>
      <reference source="ssg" ref_id="package_cronie_installed"/></metadata>
      <criteria>
        <criterion comment="package cronie is installed" test_ref="oval:ssg-test_package_cronie_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_firewalld_installed:def:1" version="1">
      <metadata>
        <title>Package firewalld Installed</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package firewalld should be installed.</description>
      <reference source="ssg" ref_id="package_firewalld_installed"/></metadata>
      <criteria>
        <criterion comment="package firewalld is installed" test_ref="oval:ssg-test_package_firewalld_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-postfix_network_listening_disabled:def:1" version="2">
      <metadata>
        <title>Postfix network listening should be disabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Postfix network listening should be disabled</description>
      <reference source="ssg" ref_id="postfix_network_listening_disabled"/></metadata>
      <criteria operator="OR">
        <!-- postfix package not installed or postfix service not configured to start -->
        <extend_definition comment="Postfix installed and configured to start" negate="true" definition_ref="oval:ssg-service_postfix_enabled:def:1"/>
        <!-- postfix network listening disabled -->
        <criterion comment="Check inet_interfaces in /etc/postfix/main.cf" test_ref="oval:ssg-test_postfix_network_listening_disabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_files_groupownership:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All syslog log files should be owned by the appropriate group.</description>
      <reference source="ssg" ref_id="rsyslog_files_groupownership"/></metadata>
      <criteria>
        <criterion comment="Check if all system log files are owned by root group" test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_files_ownership:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All syslog log files should be owned by the appropriate user.</description>
      <reference source="ssg" ref_id="rsyslog_files_ownership"/></metadata>
      <criteria>
        <criterion comment="Check if all system log files are owned by root user" test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_files_permissions:def:1" version="1">
      <metadata>
        <title>Confirm Existence and Permissions of System Log Files</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>File permissions for all syslog log files should be set correctly.</description>
      <reference source="ssg" ref_id="rsyslog_files_permissions"/></metadata>
      <criteria>
        <criterion comment="Check permissions of all system log files" test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-xwindows_runlevel_setting:def:1" version="1">
      <metadata>
        <title>Disable X Windows Startup By Setting Default SystemD Target</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Checks /etc/systemd/system/default.target to ensure that the default runlevel target is set to multi-user.target.</description>
      <reference source="ssg" ref_id="xwindows_runlevel_setting"/></metadata>
      <criteria>
        <criterion comment="default.target systemd softlink exists" test_ref="oval:ssg-test_disable_xwindows_runlevel:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_logon_fail_delay:def:1" version="1">
      <metadata>
        <title>Ensure that FAIL_DELAY is Configured in /etc/login.defs</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The delay between failed authentication attempts should be
      set for all users specified in /etc/login.defs</description>
      <reference source="ssg" ref_id="accounts_logon_fail_delay"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_accounts_logon_fail_delay:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1" version="4">
      <metadata>
        <title>Lock out the root account after failed login attempts</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The root account should be configured to deny access after the number of defined
      failed attempts has been reached.</description>
      <reference source="ssg" ref_id="accounts_passwords_pam_faillock_deny_root"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_pam_faillock_preauth_silent_system-auth:tst:1" comment="pam_faillock.so preauth silent set in system-auth"/>
        <criterion test_ref="oval:ssg-test_pam_faillock_authfail_deny_root_system-auth:tst:1" comment="pam_faillock.so authfail deny_root value set in system-auth"/>
        <criterion test_ref="oval:ssg-test_pam_faillock_preauth_silent_password-auth:tst:1" comment="pam_faillock.so preauth silent set in password-auth"/>
        <criterion test_ref="oval:ssg-test_pam_faillock_authfail_deny_root_password-auth:tst:1" comment="pam_faillock.so authfail deny_root value set in password-auth"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-clean_components_post_updating:def:1" version="1">
      <metadata>
        <title>Ensure YUM Removes Previous Package Versions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The clean_requirements_on_remove option should be used to ensure that old 
      versions of software components are removed after updating.</description>
      <reference source="ssg" ref_id="clean_components_post_updating"/></metadata>
      <criteria>
        <criterion comment="check value of clean_requirements_on_remove in /etc/yum.conf" test_ref="oval:ssg-test_yum_clean_components_post_updating:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-enable_x11_forwarding:def:1" version="1">
      <metadata>
        <title>Enable X11 Forwarding</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Enable X11Forwarding to encrypt X11 remote connections over SSH.</description>
      <reference source="ssg" ref_id="enable_x11_forwarding"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check X11Forwarding in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_x11_forwarding:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_gpgcheck_local_packages:def:1" version="1">
      <metadata>
        <title>Ensure gpgcheck Enabled for Local Packages</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The localpkg_gpgcheck option should be used to ensure that checking 
      of an RPM package's signature always occurs prior to its
      installation.</description>
      <reference source="ssg" ref_id="ensure_gpgcheck_local_packages"/></metadata>
      <criteria>
        <criterion comment="check value of localpkg_gpgcheck in /etc/yum.conf" test_ref="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_gpgcheck_repo_metadata:def:1" version="1">
      <metadata>
        <title>Ensure gpgcheck Enabled for Repository Metadata</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The repo_gpgcheck option should be used to ensure that checking
      of repository metadata always occurs.</description>
      <reference source="ssg" ref_id="ensure_gpgcheck_repo_metadata"/></metadata>
      <criteria>
        <criterion comment="check value of repo_gpgcheck in /etc/yum.conf" test_ref="oval:ssg-test_yum_ensure_gpgcheck_repo_metadata:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_groupowner_cron_allow:def:1" version="1">
      <metadata>
        <title>Verify group who owns 'cron.allow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The /etc/cron.allow file should be owned by the appropriate
      group.</description>
        <reference source="galford" ref_id="20161116" ref_url="test_attestation"/>
      <reference source="ssg" ref_id="file_groupowner_cron_allow"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_groupowner_etc_cron_allow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_owner_cron_allow:def:1" version="1">
      <metadata>
        <title>Verify user who owns 'cron.allow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The /etc/cron.allow file should be owned by the
      appropriate user.</description>
        <reference source="galford" ref_id="20161116" ref_url="test_attestation"/>
      <reference source="ssg" ref_id="file_owner_cron_allow"/></metadata>
      <criteria>
        <criterion comment="Check file ownership of /etc/cron.allow" test_ref="oval:ssg-test_userowner_cron_allow_file:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_sshd_private_key:def:1" version="1">
      <metadata>
        <title>SSH Server Private Key Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>File permissions for the SSH Server's private keys should be
set to 0640 (or stronger). By default, these files are located at /etc/ssh.</description>
      <reference source="ssg" ref_id="file_permissions_sshd_private_key"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_permissions_sshd_private_key:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_sshd_pub_key:def:1" version="1">
      <metadata>
        <title>SSHD Service Public Key Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>File permissions for the SSH Server's public keys should be
set to 0644 (or stronger). By default, these files are located at /etc/ssh.</description>
      <reference source="ssg" ref_id="file_permissions_sshd_pub_key"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_permissions_sshd_pub_key:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_unauthorized_sgid:def:1" version="2">
      <metadata>
        <title>Find setgid files system packages</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>All files with setgid should be owned by a base system package</description>
      <reference source="ssg" ref_id="file_permissions_unauthorized_sgid"/></metadata>
      <criteria>
        <criterion comment="Check all setgid files" test_ref="oval:ssg-check_setgid_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_unauthorized_suid:def:1" version="1">
      <metadata>
        <title>Find setuid files from system packages</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>All files with setuid should be owned by a base system package</description>
      <reference source="ssg" ref_id="file_permissions_unauthorized_suid"/></metadata>
      <criteria>
        <criterion comment="Check all setuid files" test_ref="oval:ssg-check_setuid_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-grub2_enable_fips_mode:def:1" version="1">
      <metadata>
        <title>Enable FIPS Mode in GRUB2</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Look for argument fips=1 in the kernel line in /etc/default/grub.</description>
      <reference source="ssg" ref_id="grub2_enable_fips_mode"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is RHEL7" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
        <extend_definition comment="prelink disabled" definition_ref="oval:ssg-disable_prelink:def:1"/>
        <extend_definition comment="package dracut-fips installed" definition_ref="oval:ssg-package_dracut-fips_installed:def:1"/>
        <criteria operator="OR">
          <criterion test_ref="oval:ssg-test_grub2_enable_fips_mode:tst:1" comment="check for fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
          <criteria operator="AND">
            <criterion test_ref="oval:ssg-test_grub2_default_exists:tst:1" comment="check for GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub"/>
            <criterion test_ref="oval:ssg-test_grub2_enable_fips_mode_default:tst:1" comment="check for fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
            <criterion test_ref="oval:ssg-test_grub2_enable_fips_mode:tst:1" comment="check for fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_PAE_kernel_on_x86-32:def:1" version="2">
      <metadata>
        <title>Package kernel-PAE Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package kernel-PAE should be installed on 32-bit
      systems.</description>
      <reference source="ssg" ref_id="install_PAE_kernel_on_x86-32"/></metadata>
      <criteria operator="OR">
        <!-- System is either not 32-bit one. In that case there's
           nothing more to check -->
        <extend_definition comment="Not a 32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1" negate="true"/>
        <!-- Or system is 32-bit one. Then check if kernel-PAE rpm
           is installed the test to succeed -->
        <criteria operator="AND">
          <extend_definition comment="A 32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
          <criterion comment="Package kernel-PAE is installed" test_ref="oval:ssg-test_package_kernel-PAE_installed:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_bluetooth_disabled:def:1" version="1">
      <metadata>
        <title>Disable bluetooth Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel module bluetooth should be disabled.</description>
      <reference source="ssg" ref_id="kernel_module_bluetooth_disabled"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.conf"/>
        <criterion test_ref="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" comment="kernel module bluetooth disabled in /etc/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" comment="kernel module bluetooth disabled in /run/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_cramfs_disabled:def:1" version="1">
      <metadata>
        <title>Disable cramfs Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel module cramfs should be disabled.</description>
      <reference source="ssg" ref_id="kernel_module_cramfs_disabled"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_cramfs_disabled:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.conf"/>
        <criterion test_ref="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" comment="kernel module cramfs disabled in /etc/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" comment="kernel module cramfs disabled in /run/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" comment="kernel module cramfs disabled in /usr/lib/modules-load.d"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_freevxfs_disabled:def:1" version="1">
      <metadata>
        <title>Disable freevxfs Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel module freevxfs should be disabled.</description>
      <reference source="ssg" ref_id="kernel_module_freevxfs_disabled"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.conf"/>
        <criterion test_ref="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" comment="kernel module freevxfs disabled in /etc/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" comment="kernel module freevxfs disabled in /run/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_hfs_disabled:def:1" version="1">
      <metadata>
        <title>Disable hfs Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel module hfs should be disabled.</description>
      <reference source="ssg" ref_id="kernel_module_hfs_disabled"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_hfs_disabled:tst:1" comment="kernel module hfs disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" comment="kernel module hfs disabled in /etc/modprobe.conf"/>
        <criterion test_ref="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" comment="kernel module hfs disabled in /etc/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" comment="kernel module hfs disabled in /run/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" comment="kernel module hfs disabled in /usr/lib/modules-load.d"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_hfsplus_disabled:def:1" version="1">
      <metadata>
        <title>Disable hfsplus Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel module hfsplus should be disabled.</description>
      <reference source="ssg" ref_id="kernel_module_hfsplus_disabled"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.conf"/>
        <criterion test_ref="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" comment="kernel module hfsplus disabled in /etc/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" comment="kernel module hfsplus disabled in /run/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_jffs2_disabled:def:1" version="1">
      <metadata>
        <title>Disable jffs2 Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel module jffs2 should be disabled.</description>
      <reference source="ssg" ref_id="kernel_module_jffs2_disabled"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_jffs2_disabled:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.conf"/>
        <criterion test_ref="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" comment="kernel module jffs2 disabled in /etc/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" comment="kernel module jffs2 disabled in /run/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_sctp_disabled:def:1" version="1">
      <metadata>
        <title>Disable sctp Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel module sctp should be disabled.</description>
      <reference source="ssg" ref_id="kernel_module_sctp_disabled"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_sctp_disabled:tst:1" comment="kernel module sctp disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_sctp_modprobeconf:tst:1" comment="kernel module sctp disabled in /etc/modprobe.conf"/>
        <criterion test_ref="oval:ssg-test_kernmod_sctp_etcmodules-load:tst:1" comment="kernel module sctp disabled in /etc/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_sctp_runmodules-load:tst:1" comment="kernel module sctp disabled in /run/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_sctp_libmodules-load:tst:1" comment="kernel module sctp disabled in /usr/lib/modules-load.d"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_squashfs_disabled:def:1" version="1">
      <metadata>
        <title>Disable squashfs Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel module squashfs should be disabled.</description>
      <reference source="ssg" ref_id="kernel_module_squashfs_disabled"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_squashfs_disabled:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.conf"/>
        <criterion test_ref="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" comment="kernel module squashfs disabled in /etc/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" comment="kernel module squashfs disabled in /run/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" comment="kernel module squashfs disabled in /usr/lib/modules-load.d"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_udf_disabled:def:1" version="1">
      <metadata>
        <title>Disable udf Kernel Module</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel module udf should be disabled.</description>
      <reference source="ssg" ref_id="kernel_module_udf_disabled"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_udf_disabled:tst:1" comment="kernel module udf disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" comment="kernel module udf disabled in /etc/modprobe.conf"/>
        <criterion test_ref="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" comment="kernel module udf disabled in /etc/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" comment="kernel module udf disabled in /run/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" comment="kernel module udf disabled in /usr/lib/modules-load.d"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_krb_sec_remote_filesystems:def:1" version="1">
      <metadata>
        <title>Mount Remote Filesystems with Kerberos Security</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The Kerberos security option should be enabled for all NFS mounts in /etc/fstab.</description>
      <reference source="ssg" ref_id="mount_option_krb_sec_remote_filesystems"/></metadata>
      <criteria operator="XOR">
        <!-- these tests are designed to be mutually exclusive; either no nfs mounts exist in /etc/fstab -->
        <!-- or all of the nfs mounts defined in /etc/fstab have the sec mount option specified -->
        <criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_no_nfs_defined_etc_fstab_krb_sec:tst:1"/>
        <criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_nfs_krb_sec_etc_fstab:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_disable_ddns_interfaces:def:1" version="1">
      <metadata>
        <title>Disable Client Dynamic DNS Updates</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Clients should not automatically update their own
      DNS record.</description>
      <reference source="ssg" ref_id="network_disable_ddns_interfaces"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_network_disable_ddns_interfaces_ifcfg:tst:1"/>
        <criterion test_ref="oval:ssg-test_network_disable_ddns_interfaces_dhclient:tst:1"/>
        <criterion test_ref="oval:ssg-test_network_disable_ddns_interfaces_dhcp:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_aide_installed:def:1" version="1">
      <metadata>
        <title>Package aide Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package aide should be installed.</description>
      <reference source="ssg" ref_id="package_aide_installed"/></metadata>
      <criteria>
        <criterion comment="package aide is installed" test_ref="oval:ssg-test_package_aide_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_dconf_installed:def:1" version="1">
      <metadata>
        <title>Package dconf Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package dconf should be installed.</description>
      <reference source="ssg" ref_id="package_dconf_installed"/></metadata>
      <criteria>
        <criterion comment="package dconf is installed" test_ref="oval:ssg-test_package_dconf_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_vsftpd_installed:def:1" version="1">
      <metadata>
        <title>Package vsftpd Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package vsftpd should be installed.</description>
      <reference source="ssg" ref_id="package_vsftpd_installed"/></metadata>
      <criteria>
        <criterion comment="package vsftpd is installed" test_ref="oval:ssg-test_package_vsftpd_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_cron_logging:def:1" version="1">
      <metadata>
        <title>Verify Cron is Logging to Rsyslog</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Rsyslog should be configured to capture cron messages.</description>
        <reference source="galford" ref_id="20161116" ref_url="test_attestation"/>
      <reference source="ssg" ref_id="rsyslog_cron_logging"/></metadata>
      <criteria operator="OR">
        <criterion comment="cron is configured in /etc/rsyslog.conf" test_ref="oval:ssg-test_cron_logging_rsyslog:tst:1"/>
        <criterion comment="cron is configured in /etc/rsyslog.d" test_ref="oval:ssg-test_cron_logging_rsyslog_dir:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-service_nails_enabled:def:1" version="2">
      <metadata>
        <title>Service nails Enabled</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The nails service should be enabled if possible.</description>
      <reference source="ssg" ref_id="service_nails_enabled"/></metadata>
      <criteria operator="OR" comment="service nails is configured to start">
        <criterion comment="nails runlevel 0" test_ref="oval:ssg-test_runlevel0_nails:tst:1"/>
        <criterion comment="nails runlevel 1" test_ref="oval:ssg-test_runlevel1_nails:tst:1"/>
        <criterion comment="nails runlevel 2" test_ref="oval:ssg-test_runlevel2_nails:tst:1"/>
        <criterion comment="nails runlevel 3" test_ref="oval:ssg-test_runlevel3_nails:tst:1"/>
        <criterion comment="nails runlevel 4" test_ref="oval:ssg-test_runlevel4_nails:tst:1"/>
        <criterion comment="nails runlevel 5" test_ref="oval:ssg-test_runlevel5_nails:tst:1"/>
        <criterion comment="nails runlevel 6" test_ref="oval:ssg-test_runlevel6_nails:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_compression:def:1" version="1">
      <metadata>
        <title>Disable Compression Or Set Compression to delayed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>SSH should either have compression disabled or set to delayed.</description>
      <reference source="ssg" ref_id="sshd_disable_compression"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check Compression in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_compression:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_gssapi_auth:def:1" version="1">
      <metadata>
        <title>Disable GSSAPI Authentication</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Unless needed, disable the GSSAPI authentication option for
the SSH Server.</description>
      <reference source="ssg" ref_id="sshd_disable_gssapi_auth"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check GSSAPIAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_gssapi_auth:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_kerb_auth:def:1" version="1">
      <metadata>
        <title>Disable Kerberos Authentication</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Unless needed, disable the Kerberos authentication option for
the SSH Server.</description>
      <reference source="ssg" ref_id="sshd_disable_kerb_auth"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check KerberosAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_kerb_auth:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_enable_strictmodes:def:1" version="1">
      <metadata>
        <title>Enable SSH Server's Strict Mode</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Enable StrictMode to check users home directory permissions
and configurations.</description>
      <reference source="ssg" ref_id="sshd_enable_strictmodes"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check StrictModes in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_strictmodes:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_print_last_log:def:1" version="1">
      <metadata>
        <title>Enable Print Last Log</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Enable PrintLastLogStrict to display user's last login time 
and date.</description>
      <reference source="ssg" ref_id="sshd_print_last_log"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check PrintLastLog in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_printlastlog:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_use_priv_separation:def:1" version="1">
      <metadata>
        <title>Use Priviledge Separation</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Use priviledge separation to cause the SSH process to drop
root privileges when not needed.</description>
      <reference source="ssg" ref_id="sshd_use_priv_separation"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check UsePrivilegeSeparation in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_use_priv_separation:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sudo_remove_no_authenticate:def:1" version="1">
      <metadata>
        <title>Ensure !authenticate Is Not Used in Sudo</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Checks interactive shell timeout</description>
      <reference source="ssg" ref_id="sudo_remove_no_authenticate"/></metadata>
      <criteria operator="AND">
        <criterion comment="!authenticate does not exist in /etc/sudoers" test_ref="oval:ssg-test_no_authenticate_etc_sudoers:tst:1"/>
        <criterion comment="!authenticate does not exist in /etc/sudoers.d" test_ref="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sudo_remove_nopasswd:def:1" version="1">
      <metadata>
        <title>Ensure NOPASSWD Is Not Used in Sudo</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Checks interactive shell timeout</description>
      <reference source="ssg" ref_id="sudo_remove_nopasswd"/></metadata>
      <criteria operator="AND">
        <criterion comment="NOPASSWD is not configured in /etc/sudoers" test_ref="oval:ssg-test_nopasswd_etc_sudoers:tst:1"/>
        <criterion comment="NOPASSWD is not configured in /etc/sudoers.d" test_ref="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "fs.suid_dumpable" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_fs_suid_dumpable"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="fs.suid_dumpable configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1"/>
        <extend_definition comment="fs.suid_dumpable runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.all.accept_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_accept_redirects"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_source_route" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.all.accept_source_route" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_accept_source_route"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.log_martians" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.all.log_martians" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_log_martians"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.log_martians configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.log_martians runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.rp_filter" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.all.rp_filter" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_rp_filter"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.rp_filter configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.rp_filter runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.secure_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.all.secure_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_secure_redirects"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.secure_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.secure_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.send_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.all.send_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_send_redirects"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.all.send_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.all.send_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.default.accept_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_accept_redirects"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.default.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.default.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_source_route" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.default.accept_source_route" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_accept_source_route"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.default.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1"/>
        <extend_definition comment="net.ipv4.conf.default.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.log_martians" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.default.log_martians" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_log_martians"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.default.log_martians configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1"/>
        <extend_definition comment="net.ipv4.conf.default.log_martians runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.rp_filter" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.default.rp_filter" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_rp_filter"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.default.rp_filter configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1"/>
        <extend_definition comment="net.ipv4.conf.default.rp_filter runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.secure_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.default.secure_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_secure_redirects"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.default.secure_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.default.secure_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.send_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.conf.default.send_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_send_redirects"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.conf.default.send_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1"/>
        <extend_definition comment="net.ipv4.conf.default.send_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_echo_ignore_broadcasts" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.icmp_echo_ignore_broadcasts" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.icmp_echo_ignore_broadcasts configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1"/>
        <extend_definition comment="net.ipv4.icmp_echo_ignore_broadcasts runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_ignore_bogus_error_responses" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.icmp_ignore_bogus_error_responses" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.icmp_ignore_bogus_error_responses configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1"/>
        <extend_definition comment="net.ipv4.icmp_ignore_bogus_error_responses runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.ip_forward" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_ip_forward"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.ip_forward configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1"/>
        <extend_definition comment="net.ipv4.ip_forward runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.tcp_syncookies" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv4.tcp_syncookies" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv4_tcp_syncookies"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="net.ipv4.tcp_syncookies configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1"/>
        <extend_definition comment="net.ipv4.tcp_syncookies runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_ra" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv6.conf.all.accept_ra" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_accept_ra"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.all.accept_ra configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra:def:1"/>
          <extend_definition comment="net.ipv6.conf.all.accept_ra runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv6.conf.all.accept_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_accept_redirects"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_redirects set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.all.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_redirects:def:1"/>
          <extend_definition comment="net.ipv6.conf.all.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_redirects:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_source_route" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv6.conf.all.accept_source_route" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_accept_source_route"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_source_route set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.all.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_source_route:def:1"/>
          <extend_definition comment="net.ipv6.conf.all.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_source_route:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_forwarding:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.forwarding" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv6.conf.all.forwarding" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_forwarding"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.all.forwarding set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.all.forwarding configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_forwarding:def:1"/>
          <extend_definition comment="net.ipv6.conf.all.forwarding runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_forwarding:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_ra" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv6.conf.default.accept_ra" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_ra"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.default.accept_ra configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1"/>
          <extend_definition comment="net.ipv6.conf.default.accept_ra runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_redirects" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv6.conf.default.accept_redirects" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_redirects"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_redirects set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.default.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1"/>
          <extend_definition comment="net.ipv6.conf.default.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route:def:1" version="4">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_source_route" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "net.ipv6.conf.default.accept_source_route" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_source_route"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_source_route set correctly" operator="OR">
        <extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.default.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_source_route:def:1"/>
          <extend_definition comment="net.ipv6.conf.default.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_source_route:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "fs.suid_dumpable" parameter should be set to "0" in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_fs_suid_dumpable"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="oval:ssg-test_runtime_sysctl_fs_suid_dumpable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.accept_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_accept_redirects"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_source_route" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.accept_source_route" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_accept_source_route"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.log_martians" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.log_martians" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_log_martians"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_log_martians:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.rp_filter" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.rp_filter" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_rp_filter"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_rp_filter:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.secure_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.secure_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_secure_redirects"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_secure_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.send_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.send_redirects" parameter should be set to "0" in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_send_redirects"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_send_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.accept_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_accept_redirects"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_source_route" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.accept_source_route" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_accept_source_route"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.log_martians" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.log_martians" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_log_martians"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_log_martians:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.rp_filter" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.rp_filter" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_rp_filter"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_rp_filter:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.secure_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.secure_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_secure_redirects"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_secure_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.send_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.send_redirects" parameter should be set to "0" in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_send_redirects"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_send_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_echo_ignore_broadcasts" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.icmp_echo_ignore_broadcasts" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_ignore_bogus_error_responses" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.icmp_ignore_bogus_error_responses" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.ip_forward" parameter should be set to "0" in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_ip_forward"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.ip_forward set to 0" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_ip_forward:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.tcp_syncookies" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.tcp_syncookies" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_tcp_syncookies"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_tcp_syncookies:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_ra" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_ra" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv6_conf_all_accept_ra:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_accept_redirects"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv6_conf_all_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_source_route" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_source_route" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_accept_source_route"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv6_conf_all_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_forwarding:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.forwarding" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.forwarding" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_forwarding"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.all.forwarding set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv6_conf_all_forwarding:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_ra" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_ra" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv6_conf_default_accept_ra:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_redirects" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_redirects" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_redirects"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv6_conf_default_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_source_route" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_source_route" parameter should be set to the appropriate value in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_source_route"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv6_conf_default_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3">
      <metadata>
        <title>Kernel "fs.suid_dumpable" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "fs.suid_dumpable" parameter should be set to "0" in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_fs_suid_dumpable"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1"/>
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1"/>
        <criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.accept_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_accept_redirects"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.accept_source_route" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.accept_source_route" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_accept_source_route"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.log_martians" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.log_martians" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_log_martians"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.rp_filter" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.rp_filter" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_rp_filter"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.secure_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.secure_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_secure_redirects"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.all.send_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.all.send_redirects" parameter should be set to "0" in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_send_redirects"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.accept_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_accept_redirects"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.accept_source_route" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.accept_source_route" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_accept_source_route"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.log_martians" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.log_martians" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_log_martians"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.rp_filter" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.rp_filter" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_rp_filter"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.secure_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.secure_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_secure_redirects"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.conf.default.send_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.conf.default.send_redirects" parameter should be set to "0" in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_send_redirects"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_echo_ignore_broadcasts" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.icmp_echo_ignore_broadcasts" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.icmp_ignore_bogus_error_responses" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.icmp_ignore_bogus_error_responses" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.ip_forward" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.ip_forward" parameter should be set to "0" in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_ip_forward"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv4.tcp_syncookies" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv4.tcp_syncookies" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv4_tcp_syncookies"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1"/>
        <criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_ra" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_ra" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_accept_ra"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_accept_redirects"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_redirects:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.accept_source_route" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.accept_source_route" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_accept_source_route"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_source_route:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_source_route:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_source_route:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.all.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_forwarding:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.forwarding" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.forwarding" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_forwarding"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv6.conf.all.forwarding set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_forwarding:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv6.conf.all.forwarding set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_forwarding:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.all.forwarding set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_forwarding:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.all.forwarding set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_forwarding:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_ra" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_ra" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_ra"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_redirects" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_redirects" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_redirects"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_source_route:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.default.accept_source_route" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.default.accept_source_route" parameter should be set to the appropriate value in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_source_route"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_source_route:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_source_route:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_source_route:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.default.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_source_route:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-use_kerberos_security_all_exports:def:1" version="3">
      <metadata>
        <title>Use Kerberos Security on All Exports</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Using Kerberos Security allows to cryptography authenticate a
      valid user to an NFS share.</description>
      <reference source="ssg" ref_id="use_kerberos_security_all_exports"/></metadata>
      <criteria operator="OR">
        <criterion comment="Check for Kerberos settings in /etc/exports" test_ref="oval:ssg-test_use_kerberos_security_all_exports:tst:1"/>
        <criterion comment="Check for a share in /etc/exports" test_ref="oval:ssg-test_non_empty_exports_file:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-account_disable_post_pw_expiration:def:1" version="2">
      <metadata>
        <title>Set Accounts to Expire Following Password Expiration</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The accounts should be configured to expire automatically following password expiration.</description>
      <reference source="ssg" ref_id="account_disable_post_pw_expiration"/></metadata>
      <criteria comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd">
        <criterion test_ref="oval:ssg-test_etc_default_useradd_inactive:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-account_unique_name:def:1" version="1">
      <metadata>
        <title>Set All Accounts To Have Unique Names</title>
        <affected family="unix">
        </affected>
        <description>All accounts on the system should have unique names for proper accountability.</description>
      <reference source="ssg" ref_id="account_unique_name"/></metadata>
      <criteria comment="There should not exist duplicate user name entries in /etc/passwd">
        <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_max_concurrent_login_sessions:def:1" version="1">
      <metadata>
        <title>Set Maximum Number of Concurrent Login Sessions Per User</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The maximum number of concurrent login sessions per user should meet
      minimum requirements.</description>
      <reference source="ssg" ref_id="accounts_max_concurrent_login_sessions"/></metadata>
      <criteria operator="OR">
        <criterion comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" test_ref="oval:ssg-test_limitsd_maxlogins:tst:1"/>
        <criteria operator="AND">
          <criterion comment="the value maxlogins should not be set at all in /etc/security/limits.d/*.conf" test_ref="oval:ssg-test_limitsd_maxlogins_exists:tst:1" negate="true"/>
          <criterion comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" test_ref="oval:ssg-test_maxlogins:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_maximum_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The maximum password age policy should meet minimum requirements.</description>
      <reference source="ssg" ref_id="accounts_maximum_age_login_defs"/></metadata>
      <criteria comment="The value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
        <criterion test_ref="oval:ssg-test_pass_max_days:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_minimum_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The minimum password age policy should be set appropriately.</description>
      <reference source="ssg" ref_id="accounts_minimum_age_login_defs"/></metadata>
      <criteria comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
        <criterion test_ref="oval:ssg-test_pass_min_days:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_no_uid_except_zero:def:1" version="1">
      <metadata>
        <title>UID 0 Belongs Only To Root</title>
        <affected family="unix">
        </affected>
        <description>Only the root account should be assigned a user id of 0.</description>
      <reference source="ssg" ref_id="accounts_no_uid_except_zero"/></metadata>
      <criteria>
        <criterion comment="tests that there are no accounts with UID 0 except root in the /etc/passwd file" test_ref="oval:ssg-test_accounts_no_uid_except_root:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_all_shadowed:def:1" version="1">
      <metadata>
        <title>All Password Hashes Shadowed</title>
        <affected family="unix">
        </affected>
        <description>All password hashes should be shadowed.</description>
      <reference source="ssg" ref_id="accounts_password_all_shadowed"/></metadata>
      <criteria>
        <criterion comment="password hashes are shadowed" test_ref="oval:ssg-test_accounts_password_all_shadowed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_minlen_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The password minimum length should be set appropriately.</description>
      <reference source="ssg" ref_id="accounts_password_minlen_login_defs"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_pass_min_len:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_dcredit:def:1" version="1">
      <metadata>
        <title>Set Password dcredit Requirements</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The password dcredit should meet minimum requirements</description>
      <reference source="ssg" ref_id="accounts_password_pam_dcredit"/></metadata>
      <criteria operator="AND" comment="conditions for dcredit are satisfied">
        <extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
        <criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_dcredit:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_difok:def:1" version="2">
      <metadata>
        <title>Set Password difok Requirements</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The password difok should meet minimum requirements</description>
      <reference source="ssg" ref_id="accounts_password_pam_difok"/></metadata>
      <criteria operator="AND" comment="conditions for difok are satisfied">
        <extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
        <criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_difok:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_lcredit:def:1" version="2">
      <metadata>
        <title>Set Password lcredit Requirements</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The password lcredit should meet minimum requirements</description>
      <reference source="ssg" ref_id="accounts_password_pam_lcredit"/></metadata>
      <criteria operator="AND" comment="conditions for lcredit are satisfied">
        <extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
        <criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_lcredit:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_maxclassrepeat:def:1" version="1">
      <metadata>
        <title>Set Password maxclassrepeat Requirements</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The password maxclassrepeat should meet minimum
      requirements using pam_pwquality</description>
      <reference source="ssg" ref_id="accounts_password_pam_maxclassrepeat"/></metadata>
      <criteria operator="AND" comment="conditions for maxclassrepeat are satisfied">
        <extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
        <criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_maxrepeat:def:1" version="1">
      <metadata>
        <title>Set Password maxrepeat Requirements</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The password maxrepeat should meet minimum
      requirements using pam_pwquality</description>
      <reference source="ssg" ref_id="accounts_password_pam_maxrepeat"/></metadata>
      <criteria operator="AND" comment="conditions for maxrepeat are satisfied">
        <extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
        <criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_minclass:def:1" version="1">
      <metadata>
        <title>Set Password minclass Requirements</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The password minclass should meet the minimum requirements</description>
      <reference source="ssg" ref_id="accounts_password_pam_minclass"/></metadata>
      <criteria operator="AND" comment="conditions for minclass are satisfied">
        <extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
        <criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_minclass:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_minlen:def:1" version="1">
      <metadata>
        <title>Set Password minlen Requirements</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The password minlen should meet minimum requirements</description>
      <reference source="ssg" ref_id="accounts_password_pam_minlen"/></metadata>
      <criteria operator="AND" comment="system uses pam_pwquality configured">
        <extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
        <criterion comment="pam_pwquality" test_ref="oval:ssg-test_password_pam_pwquality_minlen:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_ocredit:def:1" version="2">
      <metadata>
        <title>Set Password ocredit Requirements</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The password ocredit should meet minimum requirements</description>
      <reference source="ssg" ref_id="accounts_password_pam_ocredit"/></metadata>
      <criteria operator="AND" comment="conditions for ocredit are satisfied">
        <extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
        <criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_ocredit:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_pwquality:def:1" version="1">
      <metadata>
        <title>Check pam_pwquality Existence in system-auth</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Check that pam_pwquality.so exists in system-auth</description>
      <reference source="ssg" ref_id="accounts_password_pam_pwquality"/></metadata>
      <criteria>
        <criterion comment="Conditions for pam_pwquality are satisfied" test_ref="oval:ssg-test_password_pam_pwquality:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_retry:def:1" version="1">
      <metadata>
        <title>Set Password retry Requirements</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
        </affected>
        <description>The password retry should meet minimum requirements</description>
      <reference source="ssg" ref_id="accounts_password_pam_retry"/></metadata>
      <criteria operator="OR" comment="Conditions for retry are satisfied">
        <criteria operator="AND" comment="system is RHEL6 with pam_cracklib configured">
          <extend_definition comment="RHEL6 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel6:def:1"/>
          <criterion comment="rhel6 pam_cracklib" test_ref="oval:ssg-test_password_pam_cracklib_retry:tst:1"/>
        </criteria>
        <criteria operator="AND" comment="system is RHEL7 with pam_pwquality configured">
          <extend_definition comment="RHEL7 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
          <criterion comment="rhel7 pam_pwquality" test_ref="oval:ssg-test_password_pam_pwquality_retry:tst:1"/>
        </criteria>
        <criteria operator="AND" comment="system is Fedora with pam_pwquality configured">
          <extend_definition comment="Fedora OS installed" definition_ref="oval:ssg-installed_OS_is_fedora:def:1"/>
          <criterion comment="Fedora pam_pwquality" test_ref="oval:ssg-test_password_pam_pwquality_retry:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_ucredit:def:1" version="2">
      <metadata>
        <title>Set Password ucredit Requirements</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The password ucredit should meet minimum requirements</description>
      <reference source="ssg" ref_id="accounts_password_pam_ucredit"/></metadata>
      <criteria operator="AND" comment="conditions for ucredit are satisfied">
        <extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
        <criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_ucredit:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_pam_unix_remember:def:1" version="2">
      <metadata>
        <title>Limit Password Reuse</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The passwords to remember should be set correctly.</description>
      <reference source="ssg" ref_id="accounts_password_pam_unix_remember"/></metadata>
      <criteria comment="remember parameter of pam_unix.so or pam_pwhistory.so is set correctly" operator="OR">
        <criterion comment="remember parameter of pam_unix.so is set correctly" test_ref="oval:ssg-test_accounts_password_pam_unix_remember:tst:1"/>
        <criterion comment="remember parameter of pam_pwhistory.so is set correctly" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_password_warn_age_login_defs:def:1" version="3">
      <metadata>
        <title>Set Password Expiration Parameters</title>
        <affected family="unix">
        </affected>
        <description>The password expiration warning age should be set appropriately.</description>
      <reference source="ssg" ref_id="accounts_password_warn_age_login_defs"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_pass_warn_age:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" version="4">
      <metadata>
        <title>Lock out account after failed login attempts</title>
        <affected family="unix">
        </affected>
        <description>The number of allowed failed logins should be set correctly.</description>
      <reference source="ssg" ref_id="accounts_passwords_pam_faillock_deny"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" comment="pam_faillock.so preauth silent set in system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" comment="pam_faillock.so authfail deny value set in system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" comment="pam_faillock.so set in account phase of system-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" comment="pam_faillock.so preauth silent set in password-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" comment="pam_faillock.so authfail deny value set in password-auth"/>
        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" comment="pam_faillock.so set in account phase of password-auth"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" version="2">
      <metadata>
        <title>Lock out account after failed login attempts</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The number of allowed failed logins should be set correctly.</description>
      <reference source="ssg" ref_id="accounts_passwords_pam_faillock_interval"/></metadata>
      <criteria>
        <criterion comment="preauth default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system-auth:tst:1"/>
        <criterion comment="authfail default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:tst:1"/>
        <criterion comment="authfail default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password-auth:tst:1"/>
        <criterion comment="preauth default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" version="2">
      <metadata>
        <title>Lock out account after failed login attempts</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The number of allowed failed logins should be set correctly.</description>
      <reference source="ssg" ref_id="accounts_passwords_pam_faillock_unlock_time"/></metadata>
      <criteria>
        <criterion comment="preauth default is set to 604800" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system-auth:tst:1"/>
        <criterion comment="authfail default is set to 604800" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:tst:1"/>
        <criterion comment="authfail default is set to 604800" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password-auth:tst:1"/>
        <criterion comment="preauth default is set to 604800" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_root_path_dirs_no_write:def:1" version="2">
      <metadata>
        <title>Write permissions are disabled for group and other in all
      directories in Root's Path</title>
        <affected family="unix">
        </affected>
        <description>Check each directory in root's path and make use it does
      not grant write permission to group and other</description>
      <reference source="ssg" ref_id="accounts_root_path_dirs_no_write"/></metadata>
      <criteria comment="Check that write permission to group and other in root's path is denied">
        <criterion comment="Check for write permission to group and other in root's path" test_ref="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_tmout:def:1" version="2">
      <metadata>
        <title>Set Interactive Session Timeout</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Checks interactive shell timeout</description>
      <reference source="ssg" ref_id="accounts_tmout"/></metadata>
      <criteria operator="OR">
        <criterion comment="TMOUT value in /etc/profile &gt;= var_accounts_tmout" test_ref="oval:ssg-test_etc_profile_tmout:tst:1"/>
        <criterion comment="TMOUT value in /etc/profile.d/*.sh &gt;= var_accounts_tmout" test_ref="oval:ssg-test_etc_profiled_tmout:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_umask_etc_bashrc:def:1" version="2">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values set for bash</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The default umask for users of the bash shell</description>
      <reference source="ssg" ref_id="accounts_umask_etc_bashrc"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
        <criterion test_ref="oval:ssg-tst_accounts_umask_etc_bashrc:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_umask_etc_csh_cshrc:def:1" version="2">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values set for csh</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The default umask for users of the csh shell</description>
      <reference source="ssg" ref_id="accounts_umask_etc_csh_cshrc"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
        <criterion test_ref="oval:ssg-tst_accounts_umask_etc_csh_cshrc:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_umask_etc_login_defs:def:1" version="2">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values in /etc/login.defs</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The default umask for all users specified in /etc/login.defs</description>
      <reference source="ssg" ref_id="accounts_umask_etc_login_defs"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
        <criterion test_ref="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-accounts_umask_etc_profile:def:1" version="2">
      <metadata>
        <title>Ensure that Users Have Sensible Umask Values in /etc/profile</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The default umask for all users should be set correctly</description>
      <reference source="ssg" ref_id="accounts_umask_etc_profile"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
        <criterion test_ref="oval:ssg-tst_accounts_umask_etc_profile:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_build_database:def:1" version="2">
      <metadata>
        <title>Aide Database Must Exist</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The aide database must be initialized.</description>
      <reference source="ssg" ref_id="aide_build_database"/></metadata>
      <criteria operator="AND">
        <!-- Only the configuration when location of the Aide database file is specified in the
           form of absolute path is checked. To check any possible relative path configuration
           that might happen would require to browse whole file system (resources expensive operation).
           Case when Aide database file is configured to be written into an SQL table (possibly
           even on remote host) is out of scope of this check -->
        <criterion test_ref="oval:ssg-test_aide_build_new_database_absolute_path:tst:1"/>
        <criterion test_ref="oval:ssg-test_aide_operational_database_absolute_path:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_periodic_cron_checking:def:1" version="3">
      <metadata>
        <title>Configure Periodic Execution of AIDE</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>By default, AIDE does not install itself for periodic
      execution. Periodically running AIDE is necessary to reveal
      unexpected changes in installed files.
      </description>
      <reference source="ssg" ref_id="aide_periodic_cron_checking"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
        <criteria operator="OR">
          <criterion comment="run aide daily with cron" test_ref="oval:ssg-test_aide_periodic_cron_checking:tst:1"/>
          <criterion comment="run aide daily with cron" test_ref="oval:ssg-test_aide_crond_checking:tst:1"/>
          <criterion comment="run aide daily with cron" test_ref="oval:ssg-test_aide_var_cron_checking:tst:1"/>
          <criterion comment="run aide daily with cron.(daily|weekly|monthly)" test_ref="oval:ssg-test_aide_crontabs_checking:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_scan_notification:def:1" version="1">
      <metadata>
        <title>Configure Notification of Post-AIDE Scan Details</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>AIDE should notify appropriate personnel of the details
      of a scan after the scan has been run.</description>
      <reference source="ssg" ref_id="aide_scan_notification"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
        <criteria operator="OR">
          <criterion comment="notify personnel when aide completes" test_ref="oval:ssg-test_aide_scan_notification:tst:1"/>
          <criterion comment="notify personnel when aide completes" test_ref="oval:ssg-test_aide_var_cron_notification:tst:1"/>
          <criterion comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)" test_ref="oval:ssg-test_aide_crontabs_notification:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_use_fips_hashes:def:1" version="1">
      <metadata>
        <title>Configure AIDE to Use FIPS 140-2 for Validating Hashes</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>AIDE should be configured to use the FIPS 140-2 
      cryptographic hashes.</description>
      <reference source="ssg" ref_id="aide_use_fips_hashes"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is certified" definition_ref="oval:ssg-installed_OS_is_certified:def:1"/>
        <extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
        <criterion comment="non-FIPS hashes are not configured" test_ref="oval:ssg-test_aide_non_fips_hashes:tst:1"/>
        <criterion comment="FIPS hashes are configured" test_ref="oval:ssg-test_aide_use_fips_hashes:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_verify_acls:def:1" version="1">
      <metadata>
        <title>Configure AIDE to Verify Access Control Lists (ACLs)</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>AIDE should be configured to verify Access Control Lists (ACLs).</description>
      <reference source="ssg" ref_id="aide_verify_acls"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
        <criterion comment="acl is set in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_acls:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-aide_verify_ext_attributes:def:1" version="1">
      <metadata>
        <title>Configure AIDE to Verify Extended Attributes</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>AIDE should be configured to verify extended file attributes.</description>
      <reference source="ssg" ref_id="aide_verify_ext_attributes"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
        <criterion comment="xattrs is set in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_ext_attributes:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_chmod:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - chmod</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_chmod"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_chmod_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit chmod" test_ref="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of chmod audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of chmod audit DAC rule -->
            <criterion comment="audit augenrules 64-bit chmod" test_ref="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_chmod_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit chmod" test_ref="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of chmod audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of chmod audit DAC rule -->
            <criterion comment="audit auditctl 64-bit chmod" test_ref="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_chown:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - chown</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_chown"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_chown_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit chown" test_ref="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of chown audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of chown audit DAC rule -->
            <criterion comment="audit augenrules 64-bit chown" test_ref="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_chown_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit chown" test_ref="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of chown audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of chown audit DAC rule -->
            <criterion comment="audit auditctl 64-bit chown" test_ref="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchmod:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchmod</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_fchmod"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_fchmod_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit fchmod" test_ref="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fchmod audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fchmod audit DAC rule -->
            <criterion comment="audit augenrules 64-bit fchmod" test_ref="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_fchmod_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit fchmod" test_ref="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fchmod audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fchmod audit DAC rule -->
            <criterion comment="audit auditctl 64-bit fchmod" test_ref="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchmodat</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_fchmodat"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_fchmodat_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit fchmodat" test_ref="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fchmodat audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fchmodat audit DAC rule -->
            <criterion comment="audit augenrules 64-bit fchmodat" test_ref="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_fchmodat_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit fchmodat" test_ref="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fchmodat audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fchmodat audit DAC rule -->
            <criterion comment="audit auditctl 64-bit fchmodat" test_ref="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchown:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchown</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_fchown"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_fchown_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit fchown" test_ref="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fchown audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fchown audit DAC rule -->
            <criterion comment="audit augenrules 64-bit fchown" test_ref="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_fchown_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit fchown" test_ref="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fchown audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fchown audit DAC rule -->
            <criterion comment="audit auditctl 64-bit fchown" test_ref="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchownat:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fchownat</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_fchownat"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_fchownat_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit fchownat" test_ref="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fchownat audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fchownat audit DAC rule -->
            <criterion comment="audit augenrules 64-bit fchownat" test_ref="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_fchownat_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit fchownat" test_ref="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fchownat audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fchownat audit DAC rule -->
            <criterion comment="audit auditctl 64-bit fchownat" test_ref="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fremovexattr</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_fremovexattr"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_fremovexattr_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit fremovexattr" test_ref="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fremovexattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fremovexattr audit DAC rule -->
            <criterion comment="audit augenrules 64-bit fremovexattr" test_ref="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_fremovexattr_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit fremovexattr" test_ref="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fremovexattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fremovexattr audit DAC rule -->
            <criterion comment="audit auditctl 64-bit fremovexattr" test_ref="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - fsetxattr</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_fsetxattr"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_fsetxattr_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit fsetxattr" test_ref="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fsetxattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fsetxattr audit DAC rule -->
            <criterion comment="audit augenrules 64-bit fsetxattr" test_ref="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_fsetxattr_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit fsetxattr" test_ref="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of fsetxattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of fsetxattr audit DAC rule -->
            <criterion comment="audit auditctl 64-bit fsetxattr" test_ref="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lchown:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - lchown</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_lchown"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_lchown_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit lchown" test_ref="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of lchown audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of lchown audit DAC rule -->
            <criterion comment="audit augenrules 64-bit lchown" test_ref="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_lchown_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit lchown" test_ref="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of lchown audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of lchown audit DAC rule -->
            <criterion comment="audit auditctl 64-bit lchown" test_ref="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - lremovexattr</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_lremovexattr"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_lremovexattr_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit lremovexattr" test_ref="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of lremovexattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of lremovexattr audit DAC rule -->
            <criterion comment="audit augenrules 64-bit lremovexattr" test_ref="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_lremovexattr_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit lremovexattr" test_ref="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of lremovexattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of lremovexattr audit DAC rule -->
            <criterion comment="audit auditctl 64-bit lremovexattr" test_ref="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - lsetxattr</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_lsetxattr"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_lsetxattr_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit lsetxattr" test_ref="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of the 32-bit version of lsetxattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of the lsetxattr audit DAC rule -->
            <criterion comment="audit augenrules 64-bit lsetxattr" test_ref="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- Test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_lsetxattr_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit lsetxattr" test_ref="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of the 32-bit version of the lsetxattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of the lsetxattr audit DAC rule -->
            <criterion comment="audit auditctl 64-bit lsetxattr" test_ref="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_removexattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - removexattr</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_removexattr"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_removexattr_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit removexattr" test_ref="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of removexattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of removexattr audit DAC rule -->
            <criterion comment="audit augenrules 64-bit removexattr" test_ref="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_removexattr_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit removexattr" test_ref="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of removexattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of removexattr audit DAC rule -->
            <criterion comment="audit auditctl 64-bit removexattr" test_ref="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_dac_modification_setxattr:def:1" version="1">
      <metadata>
        <title>Audit Discretionary Access Control Modification Events - setxattr</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The changing of file permissions and attributes should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_dac_modification_setxattr"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ardm_setxattr_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit setxattr" test_ref="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of setxattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of setxattr audit DAC rule -->
            <criterion comment="audit augenrules 64-bit setxattr" test_ref="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ardm_setxattr_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit setxattr" test_ref="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of the setxattr audit DAC rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of setxattr audit DAC rule -->
            <criterion comment="audit auditctl 64-bit setxattr" test_ref="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events:def:1" version="1">
      <metadata>
        <title>Audit File Deletion Events</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Audit files deletion events.</description>
      <reference source="ssg" ref_id="audit_rules_file_deletion_events"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_audit_rules_file_deletion_events_augenrules:tst:1"/>
          <criterion comment="audit augenrules file delete" test_ref="oval:ssg-test_audit_rules_file_deletion_events_file_delete_augenrules:tst:1"/>
        </criteria>
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_audit_rules_file_deletion_events_auditctl:tst:1"/>
          <criterion comment="audit auditctl file delete" test_ref="oval:ssg-test_audit_rules_file_deletion_events_file_delete_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_immutable:def:1" version="1">
      <metadata>
        <title>Make Audit Configuration Immutable</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Force a reboot to change audit rules is enabled</description>
      <reference source="ssg" ref_id="audit_rules_immutable"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_ari_augenrules:tst:1"/>
          <criterion comment="audit augenrules configuration locked" test_ref="oval:ssg-test_ari_locked_augenrules:tst:1"/>
        </criteria>
        <!-- Test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_ari_auditctl:tst:1"/>
          <criterion comment="audit auditctl configuration locked" test_ref="oval:ssg-test_ari_locked_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_kernel_module_loading:def:1" version="1">
      <metadata>
        <title>Audit Kernel Module Loading and Unloading</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The audit rules should be configured to log information about kernel module loading and unloading.</description>
      <reference source="ssg" ref_id="audit_rules_kernel_module_loading"/></metadata>
      <criteria operator="OR">
        <!-- First check the default configuraton: 'augenrules' tool specified in 'ExecStartPost' directive of
           /usr/lib/systemd/system/auditd.service (in other words case when final /etc/audit/audit.rules
           configuration is generated from *.rules files' content present in the /etc/audit/rules.d directory) -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_augenrules:tst:1"/>
          <criterion comment="audit augenrules insmod" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_insmod_augenrules:tst:1"/>
          <criterion comment="audit augenrules rmmod" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_rmmod_augenrules:tst:1"/>
          <criterion comment="audit augenrules modprobe" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_modprobe_augenrules:tst:1"/>
          <criterion comment="audit augenrules module syscalls" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_syscall_augenrules:tst:1"/>
        </criteria>
        <!-- Check the modified configuration: 'auditctl' tool specified in 'ExecStartPost' directive of
           /usr/lib/systemd/system/auditd.service (in other words case when final /etc/audit/audit.rules is
           just loaded by 'auditctl' tool into memory) -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_auditctl:tst:1"/>
          <criterion comment="audit auditctl insmod" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_insmod_auditctl:tst:1"/>
          <criterion comment="audit auditctl rmmod" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_rmmod_auditctl:tst:1"/>
          <criterion comment="audit auditctl modprobe" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_modprobe_auditctl:tst:1"/>
          <criterion comment="audit auditctl module syscalls" test_ref="oval:ssg-test_audit_rule_kernel_module_loading_syscall_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_login_events:def:1" version="2">
      <metadata>
        <title>Record Attempts to Alter Login and Logout Events</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Audit rules should be configured to log successful and unsuccessful login and logout events.</description>
      <reference source="ssg" ref_id="audit_rules_login_events"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_arle_augenrules:tst:1"/>
          <criterion comment="audit augenrules tallylog" test_ref="oval:ssg-test_arle_tallylog_augenrules:tst:1"/>
          <criterion comment="audit augenrules faillock" test_ref="oval:ssg-test_arle_faillock_augenrules:tst:1"/>
          <criterion comment="audit augenrules lastlog" test_ref="oval:ssg-test_arle_lastlog_augenrules:tst:1"/>
        </criteria>
        <!-- Test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_arle_auditctl:tst:1"/>
          <criterion comment="audit auditctl tallylog" test_ref="oval:ssg-test_arle_tallylog_auditctl:tst:1"/>
          <criterion comment="audit auditctl faillock" test_ref="oval:ssg-test_arle_faillock_auditctl:tst:1"/>
          <criterion comment="audit auditctl lastlog" test_ref="oval:ssg-test_arle_lastlog_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_mac_modification:def:1" version="1">
      <metadata>
        <title>Record Events that Modify the System's Mandatory Access Controls</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Audit rules that detect changes to the system's mandatory access controls (SELinux) are enabled.</description>
      <reference source="ssg" ref_id="audit_rules_mac_modification"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_armm_augenrules:tst:1"/>
          <criterion comment="audit selinux changes augenrules" test_ref="oval:ssg-test_armm_selinux_watch_augenrules:tst:1"/>
        </criteria>
        <!-- Test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_armm_auditctl:tst:1"/>
          <criterion comment="audit selinux changes auditctl" test_ref="oval:ssg-test_armm_selinux_watch_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_media_export:def:1" version="1">
      <metadata>
        <title>Audit Information Export To Media</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Audit rules that detect the mounting of filesystems should be enabled.</description>
      <reference source="ssg" ref_id="audit_rules_media_export"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_audit_rules_media_export_augenrules:tst:1"/>
          <criterion comment="audit augenrules mount" test_ref="oval:ssg-test_audit_rules_media_export_mount_augenrules:tst:1"/>
        </criteria>
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_audit_rules_media_export_auditctl:tst:1"/>
          <criterion comment="audit auditctl mount" test_ref="oval:ssg-test_audit_rules_media_export_mount_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_networkconfig_modification:def:1" version="1">
      <metadata>
        <title>Record Events that Modify the System's Network Environment</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</description>
      <reference source="ssg" ref_id="audit_rules_networkconfig_modification"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_arnm_augenrules:tst:1"/>
          <criterion comment="audit network syscalls augenrules" test_ref="oval:ssg-test_arnm_syscall_augenrules:tst:1"/>
          <criterion comment="audit /etc/issue augenrules" test_ref="oval:ssg-test_arnm_etc_issue_augenrules:tst:1"/>
          <criterion comment="audit /etc/issue.net augenrules" test_ref="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1"/>
          <criterion comment="audit /etc/hosts augenrules" test_ref="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1"/>
          <criterion comment="audit /etc/sysconfig/network augenrules" test_ref="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1"/>
        </criteria>
        <!-- Test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_arnm_auditctl:tst:1"/>
          <criterion comment="audit network syscalls auditctl" test_ref="oval:ssg-test_arnm_syscall_auditctl:tst:1"/>
          <criterion comment="audit /etc/issue auditctl" test_ref="oval:ssg-test_arnm_etc_issue_auditctl:tst:1"/>
          <criterion comment="audit /etc/issue.net auditctl" test_ref="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1"/>
          <criterion comment="audit /etc/hosts auditctl" test_ref="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1"/>
          <criterion comment="audit /etc/sysconfig/network auditctl" test_ref="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_privileged_commands:def:1" version="1">
      <metadata>
        <title>Ensure auditd Collects Information on the Use of Privileged Commands</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Audit rules about the information on the use of privileged commands are enabled.</description>
      <reference source="ssg" ref_id="audit_rules_privileged_commands"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_arpc_augenrules:tst:1"/>
          <criterion comment="audit augenrules suid sgid" test_ref="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1"/>
          <criterion comment="audit augenrules binaries count matches rules count" test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1"/>
        </criteria>
        <!-- Test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_arpc_auditctl:tst:1"/>
          <criterion comment="audit auditctl suid sgid" test_ref="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1"/>
          <criterion comment="audit auditctl binaries count matches rules count" test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_session_events:def:1" version="1">
      <metadata>
        <title>Record Attempts to Alter Process and Session Initiation Information</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Audit rules should capture information about session initiation.</description>
      <reference source="ssg" ref_id="audit_rules_session_events"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_arse_augenrules:tst:1"/>
          <criterion comment="audit augenrules utmp" test_ref="oval:ssg-test_arse_utmp_augenrules:tst:1"/>
          <criterion comment="audit augenrules btmp" test_ref="oval:ssg-test_arse_btmp_augenrules:tst:1"/>
          <criterion comment="audit augenrules wtmp" test_ref="oval:ssg-test_arse_wtmp_augenrules:tst:1"/>
        </criteria>
        <!-- Test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_arse_auditctl:tst:1"/>
          <criterion comment="audit auditctl utmp" test_ref="oval:ssg-test_arse_utmp_auditctl:tst:1"/>
          <criterion comment="audit auditctl btmp" test_ref="oval:ssg-test_arse_btmp_auditctl:tst:1"/>
          <criterion comment="audit auditctl wtmp" test_ref="oval:ssg-test_arse_wtmp_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_sysadmin_actions:def:1" version="1">
      <metadata>
        <title>Audit System Administrator Actions</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Audit actions taken by system administrators on the system.</description>
      <reference source="ssg" ref_id="audit_rules_sysadmin_actions"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_augenrules:tst:1"/>
          <criterion comment="audit augenrules sudoers" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1"/>
        </criteria>
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_auditctl:tst:1"/>
          <criterion comment="audit auditctl sudoers" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_time_adjtimex:def:1" version="1">
      <metadata>
        <title>Record Attempts to Alter Time Through Adjtimex</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Record attempts to alter time through adjtimex.</description>
      <reference source="ssg" ref_id="audit_rules_time_adjtimex"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_art_adjtimex_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit adjtimex" test_ref="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of adjtimex audit rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of adjtimex audit rule -->
            <criterion comment="audit augenrules 64-bit adjtimex" test_ref="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_art_adjtimex_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit adjtimex" test_ref="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of adjtimex audit rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of adjtimex audit rule -->
            <criterion comment="audit auditctl 64-bit adjtimex" test_ref="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_time_clock_settime:def:1" version="2">
      <metadata>
        <title>Record Attempts to Alter Time Through Clock_settime</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Record attempts to alter time through clock_settime.</description>
      <reference source="ssg" ref_id="audit_rules_time_clock_settime"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_art_clock_settime_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit clock_settime" test_ref="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of clock_settime audit rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of clock_settime audit rule -->
            <criterion comment="audit augenrules 64-bit clock_settime" test_ref="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_art_clock_settime_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit clock_settime" test_ref="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of clock_settime audit rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of clock_settime audit rule -->
            <criterion comment="audit auditctl 64-bit clock_settime" test_ref="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_time_settimeofday:def:1" version="1">
      <metadata>
        <title>Record Attempts to Alter Time Through Settimeofday</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Record attempts to alter time through settimeofday.</description>
      <reference source="ssg" ref_id="audit_rules_time_settimeofday"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_art_settimeofday_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit settimeofday" test_ref="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of settimeofday audit rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of settimeofday audit rule -->
            <criterion comment="audit augenrules 64-bit settimeofday" test_ref="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1"/>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_art_settimeofday_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit settimeofday" test_ref="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of 32-bit version of settimeofday audit rule -->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of settimeofday audit rule -->
            <criterion comment="audit auditctl 64-bit settimeofday" test_ref="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_time_stime:def:1" version="1">
      <metadata>
        <title>Record Attempts to Alter Time Through Stime</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Record attempts to alter time through stime. Note that on
      64-bit architectures the stime system call is not defined in the audit
      system calls lookup table.</description>
      <reference source="ssg" ref_id="audit_rules_time_stime"/></metadata>
      <criteria operator="AND">
        <!-- System is 32-bit or 64-bit -->
        <criteria comment="32-bit or 64-bit system" operator="OR">
          <extend_definition comment="32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
          <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
        </criteria>
        <!-- augenrules or auditctl tools are used to load audit rules -->
        <criteria comment="audit augenrules or audit auditctl" operator="OR">
          <!-- Test the augenrules case -->
          <criteria comment="audit augenrules stime" operator="AND">
            <!-- augenrules is used to load audit rules and stime rule is defined in /etc/audit/rules.d/*.rules -->
            <criterion comment="audit augenrules" test_ref="oval:ssg-test_art_stime_augenrules:tst:1"/>
            <criterion comment="audit augenrules 32-bit stime" test_ref="oval:ssg-test_32bit_art_stime_augenrules:tst:1"/>
          </criteria>
          <!-- OR test the auditctl case -->
          <criteria comment="audit auditctl stime" operator="AND">
            <!-- OR auditctl is used to load audit rules and stime rule is defined in /etc/audit/audit.rules -->
            <criterion comment="audit auditctl" test_ref="oval:ssg-test_art_stime_auditctl:tst:1"/>
            <criterion comment="audit auditctl 32-bit stime" test_ref="oval:ssg-test_32bit_art_stime_auditctl:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_time_watch_localtime:def:1" version="1">
      <metadata>
        <title>Record Attempts to Alter Time Through the Localtime File</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Record attempts to alter time through /etc/localtime.</description>
      <reference source="ssg" ref_id="audit_rules_time_watch_localtime"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_artw_augenrules:tst:1"/>
          <criterion comment="audit /etc/localtime watch augenrules" test_ref="oval:ssg-test_artw_etc_localtime_augenrules:tst:1"/>
        </criteria>
        <!-- Test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_artw_auditctl:tst:1"/>
          <criterion comment="audit /etc/localtime watch auditctl" test_ref="oval:ssg-test_artw_etc_localtime_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification:def:1" version="1">
      <metadata>
        <title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
      <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification"/></metadata>
      <criteria operator="OR">
        <!-- Test the augenrules case -->
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_arufm_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit file eaccess" test_ref="oval:ssg-test_32bit_arufm_eaccess_augenrules:tst:1"/>
          <criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_augenrules:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of the 32-bit version of the EACCESS / EPERM rules-->
            <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit versions of the rules -->
            <criteria operator="AND">
              <criterion comment="audit augenrules 64-bit file eaccess" test_ref="oval:ssg-test_64bit_arufm_eaccess_augenrules:tst:1"/>
              <criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_augenrules:tst:1"/>
            </criteria>
          </criteria>
        </criteria>
        <!-- OR test the auditctl case -->
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_arufm_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit file eaccess" test_ref="oval:ssg-test_32bit_arufm_eaccess_auditctl:tst:1"/>
          <criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_auditctl:tst:1"/>
          <criteria operator="OR">
            <!-- System either isn't 64-bit => we just check presence of the 32-bit version of the EACCESS / EPERM rules -->
            <extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
            <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit versions of the rules -->
            <criteria operator="AND">
              <criterion comment="audit auditctl 64-bit file eaccess" test_ref="oval:ssg-test_64bit_arufm_eaccess_auditctl:tst:1"/>
              <criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_auditctl:tst:1"/>
            </criteria>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification:def:1" version="1">
      <metadata>
        <title>Audit User/Group Modification</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Audit user/group modification.</description>
      <reference source="ssg" ref_id="audit_rules_usergroup_modification"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <criterion comment="audit augenrules" test_ref="oval:ssg-test_audit_rules_usergroup_modification_augenrules:tst:1"/>
          <criterion comment="audit /etc/group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1"/>
          <criterion comment="audit /etc/passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1"/>
          <criterion comment="audit /etc/gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1"/>
          <criterion comment="audit /etc/shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1"/>
          <criterion comment="audit /etc/security/opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1"/>
        </criteria>
        <criteria operator="AND">
          <criterion comment="audit auditctl" test_ref="oval:ssg-test_audit_rules_usergroup_modification_auditctl:tst:1"/>
          <criterion comment="audit /etc/group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1"/>
          <criterion comment="audit /etc/passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1"/>
          <criterion comment="audit /etc/gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1"/>
          <criterion comment="audit /etc/shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1"/>
          <criterion comment="audit /etc/security/opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" version="1">
      <metadata>
        <title>The syslog Plugin Of the Audit Event Multiplexor (audispd) Is Activated</title>
        <affected family="unix">
        </affected>
        <description>active setting in /etc/audisp/plugins.d/syslog.conf is set to 'yes'</description>
      <reference source="ssg" ref_id="auditd_audispd_syslog_plugin_activated"/></metadata>
      <criteria>
        <criterion comment="active setting in syslog.conf" test_ref="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1">
      <metadata>
        <title>'log_group' Not Set To 'root' In /etc/audit/auditd.conf</title>
        <affected family="unix">
        </affected>
        <description>Verify 'log_group' is not set to 'root' in
      /etc/audit/auditd.conf.</description>
      <reference source="ssg" ref_id="auditd_conf_log_group_not_root"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" comment="Verify 'log_group' not set to 'root' in /etc/audit/auditd.conf"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_action_mail_acct:def:1" version="2">
      <metadata>
        <title>Auditd Email Account to Notify Upon Action</title>
        <affected family="unix">
        </affected>
        <description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</description>
      <reference source="ssg" ref_id="auditd_data_retention_action_mail_acct"/></metadata>
      <criteria>
        <criterion comment="action_mail_acct setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" version="2">
      <metadata>
        <title>Auditd Action to Take When Disk is Low on Space</title>
        <affected family="unix">
        </affected>
        <description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference source="ssg" ref_id="auditd_data_retention_admin_space_left_action"/></metadata>
      <criteria>
        <criterion comment="admin_space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_flush:def:1" version="1">
      <metadata>
        <title>Auditd priority for flushing data to disk</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The setting for flush in /etc/audit/auditd.conf</description>
      <reference source="ssg" ref_id="auditd_data_retention_flush"/></metadata>
      <criteria>
        <criterion comment="flush setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_flush:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file:def:1" version="2">
      <metadata>
        <title>Auditd Maximum Log File Size</title>
        <affected family="unix">
        </affected>
        <description>max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value</description>
      <reference source="ssg" ref_id="auditd_data_retention_max_log_file"/></metadata>
      <criteria>
        <criterion comment="max_log_file setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file_action:def:1" version="2">
      <metadata>
        <title>Auditd Action to Take When Maximum Log Size Reached</title>
        <affected family="unix">
        </affected>
        <description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference source="ssg" ref_id="auditd_data_retention_max_log_file_action"/></metadata>
      <criteria>
        <criterion comment="max_log_file_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_num_logs:def:1" version="2">
      <metadata>
        <title>Auditd Maximum Number of Logs to Retain</title>
        <affected family="unix">
        </affected>
        <description>num_logs setting in /etc/audit/auditd.conf is set to at least a certain value</description>
      <reference source="ssg" ref_id="auditd_data_retention_num_logs"/></metadata>
      <criteria>
        <criterion comment="num_logs setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_num_logs:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-auditd_data_retention_space_left_action:def:1" version="3">
      <metadata>
        <title>Auditd Action to Take When Disk Starting to Run Low on Space</title>
        <affected family="unix">
        </affected>
        <description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
      <reference source="ssg" ref_id="auditd_data_retention_space_left_action"/></metadata>
      <criteria>
        <criterion comment="space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_space_left_action:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-banner_etc_issue:def:1" version="2">
      <metadata>
        <title>System Login Banner Compliance</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The system login banner text should be set correctly.</description>
      <reference source="ssg" ref_id="banner_etc_issue"/></metadata>
      <criteria>
        <criterion comment="/etc/issue is set appropriately" test_ref="oval:ssg-test_banner_etc_issue:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-bootloader_audit_argument:def:1" version="2">
      <metadata>
        <title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Look for argument audit=1 in the kernel line in /etc/default/grub.</description>
      <reference source="ssg" ref_id="bootloader_audit_argument"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_bootloader_audit_argument:tst:1" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX"/>
        <criteria operator="AND">
          <criterion test_ref="oval:ssg-test_bootloader_audit_argument_default:tst:1" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"/>
          <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1">
      <metadata>
        <title>Verify GRUB_DISABLE_RECOVERY Set to true</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>GRUB_DISABLE_RECOVERY set to 'true' in
      /etc/default/grub</description>
      <reference source="ssg" ref_id="bootloader_disable_recovery_set_to_true"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-bootloader_nousb_argument:def:1" version="1">
      <metadata>
        <title>Disable Kernel Support for USB via Bootloader Configuration</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Look for 'nousb' argument in the kernel line in /etc/default/grub</description>
      <reference source="ssg" ref_id="bootloader_nousb_argument"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_bootloader_nousb_argument:tst:1" comment="Check for 'nousb' argument in /etc/default/grub"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-bootloader_password:def:1" version="1">
      <metadata>
        <title>Set Boot Loader Password</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The grub2 boot loader should have password protection enabled.</description>
      <reference source="ssg" ref_id="bootloader_password"/></metadata>
      <criteria operator="OR">
        <criterion comment="Pass if /boot/grub2/grub.cfg does not exist" test_ref="oval:ssg-test_bootloader_grub_cfg:tst:1"/>
        <criteria operator="AND">
          <criterion comment="make sure a password is defined in /boot/grub2/grub.cfg" test_ref="oval:ssg-test_bootloader_password:tst:1"/>
          <criterion comment="make sure a superuser is defined in /boot/grub2/grub.cfg" test_ref="oval:ssg-test_bootloader_superuser:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-bootloader_uefi_password:def:1" version="1">
      <metadata>
        <title>Set the UEFI Boot Loader Password</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The UEFI grub2 boot loader should have password protection enabled.</description>
      <reference source="ssg" ref_id="bootloader_uefi_password"/></metadata>
      <criteria operator="OR">
        <criterion comment="Pass if /boot/efi/EFI/redhat/grub.cfg does not exist" test_ref="oval:ssg-test_bootloader_uefi_grub_cfg:tst:1"/>
        <criteria operator="AND">
          <criterion comment="make sure a password is defined in /boot/efi/EFI/redhat/grub.cfg" test_ref="oval:ssg-test_bootloader_uefi_password:tst:1"/>
          <criterion comment="make sure a superuser is defined in /boot/efi/EFI/redhat/grub.cfg" test_ref="oval:ssg-test_bootloader_uefi_superuser:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-cups_disable_browsing:def:1" version="1">
      <metadata>
        <title>Disable Printer Browsing Entirely if Possible</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The CUPS print service can be configured to broadcast a list
      of available printers to the network. Other machines on the network, also
      running the CUPS print service, can be configured to listen to these
      broadcasts and add and configure these printers for immediate use. By
      disabling this browsing capability, the machine will no longer generate
      or receive such broadcasts.</description>
      <reference source="ssg" ref_id="cups_disable_browsing"/></metadata>
      <criteria operator="AND">
        <criterion comment="Ensure remote printer browsing is off" test_ref="oval:ssg-test_cups_disable_browsing_browsing_off:tst:1"/>
        <criterion comment="Ensure no incoming printer information packets are allowed" test_ref="oval:ssg-test_cups_disable_browsing_browseallow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-cups_disable_printserver:def:1" version="1">
      <metadata>
        <title>Disable Printer Server if Possible</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>By default, locally configured printers will not be shared
      over the network, but if this functionality has somehow been enabled,
      these recommendations will disable it again. Be sure to disable outgoing
      printer list broadcasts, or remote users will still be able to see the
      locally configured printers, even if they cannot actually print to them.
      To limit print serving to a particular set of users, use the Policy
      directive.</description>
      <reference source="ssg" ref_id="cups_disable_printserver"/></metadata>
      <criteria operator="AND">
        <criterion comment="Don't use port directive" test_ref="oval:ssg-test_cups_disable_printserver_disable_port:tst:1"/>
        <criterion comment="Do use the listen directive" test_ref="oval:ssg-test_cups_disable_printserver_use_listen:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_banner_enabled:def:1" version="1">
      <metadata>
        <title>Enable GNOME3 Login Warning Banner</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Enable the GNOME3 Login warning banner.</description>
      <reference source="ssg" ref_id="dconf_gnome_banner_enabled"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Enable GUI banner and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Enable GUI banner" test_ref="oval:ssg-test_banner_gui_enabled:tst:1"/>
          <criterion comment="Prevent user from disabling banner" test_ref="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_disable_automount:def:1" version="1">
      <metadata>
        <title>Disable GNOME3 Automounting</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The system's default desktop environment, GNOME3, will mount
      devices and removable media (such as DVDs, CDs and USB flash drives)
      whenever they are inserted into the system. Disable automount and autorun
      within GNOME3.</description>
      <reference source="ssg" ref_id="dconf_gnome_disable_automount"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Disable GNOME3 automount/autorun and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Disable automount in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_automount:tst:1"/>
          <criterion comment="Disable automount-open in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1"/>
          <criterion comment="Disable autorun in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_autorun:tst:1"/>
          <criterion comment="Prevent user from changing automount setting" test_ref="oval:ssg-test_prevent_user_gnome_automount:tst:1"/>
          <criterion comment="Prevent user from changing automount-open setting" test_ref="oval:ssg-test_prevent_user_gnome_automount_open:tst:1"/>
          <criterion comment="Prevent user from changing autorun setting" test_ref="oval:ssg-test_prevent_user_gnome_autorun:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1" version="1">
      <metadata>
        <title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable the GNOME3 ctrl-alt-del reboot key sequence in GNOME3.</description>
      <reference source="ssg" ref_id="dconf_gnome_disable_ctrlaltdel_reboot"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Disable Ctrl-Alt-Del" test_ref="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_disable_geolocation:def:1" version="1">
      <metadata>
        <title>Disable Geolocation in GNOME3</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable GNOME3 Geolocation for the clock and system.</description>
      <reference source="ssg" ref_id="dconf_gnome_disable_geolocation"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Disable system geolocation" test_ref="oval:ssg-test_disable_sys_geolocation:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_sys_geolocation:tst:1"/>
          <criterion comment="Disable clock geolocation" test_ref="oval:ssg-test_disable_clock_geolocation:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_clock_geolocation:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_disable_power_settings:def:1" version="1">
      <metadata>
        <title>Disable Power Settings in GNOME3</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable GNOME3 power settings.</description>
      <reference source="ssg" ref_id="dconf_gnome_disable_power_settings"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Disable power settings" test_ref="oval:ssg-test_disable_gnome_power_setting:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_power_setting_change:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1" version="1">
      <metadata>
        <title>Disable the GNOME3 Login Restart and Shutdown Buttons</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable the GNOME3 Login GUI Restart and Shutdown buttons to all users on the login screen.</description>
      <reference source="ssg" ref_id="dconf_gnome_disable_restart_shutdown"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Disable GUI shutdown and restart buttons and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Disable restart and shutdown buttons" test_ref="oval:ssg-test_disable_restart_buttons:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_disable_thumbnailers:def:1" version="1">
      <metadata>
        <title>Disable All GNOME3 Thumbnailers</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The system's default desktop environment, GNOME3, uses a
      number of different thumbnailer programs to generate thumbnails for any
      new or modified content in an opened folder. Disable the execution of
      these thumbnail applications within GNOME3.</description>
      <reference source="ssg" ref_id="dconf_gnome_disable_thumbnailers"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Disable Gnome3 Thumbnailers and prevent user from enabling" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Disable thumbnailers in GNOME3" test_ref="oval:ssg-test_gnome_disable_thumbnailers:tst:1"/>
          <criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_disable_user_admin:def:1" version="1">
      <metadata>
        <title>Disable User Administration in GNOME3</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable GNOME3's ability to give users some administrative rights.</description>
      <reference source="ssg" ref_id="dconf_gnome_disable_user_admin"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Disable user administration" test_ref="oval:ssg-test_disable_gnome_user_admin:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_admin:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_disable_user_list:def:1" version="1">
      <metadata>
        <title>Disable the GNOME3 Login User List</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable the GNOME3 GUI listing of all known users on the login screen.</description>
      <reference source="ssg" ref_id="dconf_gnome_disable_user_list"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Disable GUI listing of known users and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Disable user list" test_ref="oval:ssg-test_disable_user_list:tst:1"/>
          <criterion comment="Prevent user from disabling banner" test_ref="oval:ssg-test_prevent_user_disable_user_list:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_disable_wifi_create:def:1" version="1">
      <metadata>
        <title>Disable WIFI Network Connection Creation in GNOME3</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable the GNOME3 wireless network creation settings.</description>
      <reference source="ssg" ref_id="dconf_gnome_disable_wifi_create"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Disable wifi creation" test_ref="oval:ssg-test_disable_wifi_creation:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_disable_wifi_notification:def:1" version="1">
      <metadata>
        <title>Disable WIFI Network Notification in GNOME3</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable the GNOME3 wireless network notification.</description>
      <reference source="ssg" ref_id="dconf_gnome_disable_wifi_notification"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Disable wifi notification" test_ref="oval:ssg-test_disable_wifi_notification:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_enable_smartcard_auth:def:1" version="1">
      <metadata>
        <title>Enable the GNOME3 Login Smartcard Authentication</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Enable smartcard authentication in the GNOME3 Login GUI.</description>
      <reference source="ssg" ref_id="dconf_gnome_enable_smartcard_auth"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Enable smartcard authentication and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Enable smartcard authentication" test_ref="oval:ssg-test_enable_gnome_smartcard:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_disable_smartcard:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_login_banner_text:def:1" version="1">
      <metadata>
        <title>Enable GUI Warning Banner</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Enable the GUI warning banner.</description>
      <reference source="ssg" ref_id="dconf_gnome_login_banner_text"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Enable GUI banner and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Prevent user from changing banner" test_ref="oval:ssg-test_prevent_user_banner_change:tst:1"/>
          <criterion comment="Login banner is correctly set" test_ref="oval:ssg-test_gdm_login_banner_text_setting:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_login_retries:def:1" version="1">
      <metadata>
        <title>Set the GNOME3 Login Number of Failures</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Set the GNOME3 number of login failure attempts.</description>
      <reference source="ssg" ref_id="dconf_gnome_login_retries"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Set number of login attempts and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="Set number of login tries" test_ref="oval:ssg-test_configure_allowed_failures:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_allowed-failures_change:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1" version="1">
      <metadata>
        <title>Require Credential Prompting for Remote Access in GNOME3</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Configure GNOME3 to require credential prompting for remote access.</description>
      <reference source="ssg" ref_id="dconf_gnome_remote_access_credential_prompt"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="configure remote access credentials" test_ref="oval:ssg-test_configure_remote_access_creds:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_remote_access_creds:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_remote_access_encryption:def:1" version="1">
      <metadata>
        <title>Require Encryption for Remote Access in GNOME3</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Configure GNOME3 to require encryption for remote access connections.</description>
      <reference source="ssg" ref_id="dconf_gnome_remote_access_encryption"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="configure remote access encryption" test_ref="oval:ssg-test_configure_remote_access_encryption:tst:1"/>
          <criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_remote_access_encryption:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" version="1">
      <metadata>
        <title>Enable GNOME3 Screensaver Idle Activation</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Idle activation of the screen saver should be enabled.</description>
      <reference source="ssg" ref_id="dconf_gnome_screensaver_idle_activation_enabled"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="check screensaver idle activation and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="idle activation has been configured" test_ref="oval:ssg-test_screensaver_idle_activation_enabled:tst:1"/>
          <criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" version="2">
      <metadata>
        <title>Configure the GNOME3 GUI Screen locking</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The allowed period of inactivity before the screensaver is activated.</description>
      <reference source="ssg" ref_id="dconf_gnome_screensaver_idle_delay"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="check screensaver idle delay and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="idle delay has been configured" test_ref="oval:ssg-test_screensaver_idle_delay:tst:1"/>
          <criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_prevent_user_change_idle_delay:tst:1"/>
          <criterion comment="idle delay is set correctly" test_ref="oval:ssg-test_screensaver_idle_delay_setting:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1" version="2">
      <metadata>
        <title>Enable GNOME3 Screensaver Lock Delay After Idle Period</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Idle activation of the screen lock should be enabled immediately or
      after a delay.</description>
      <reference source="ssg" ref_id="dconf_gnome_screensaver_lock_delay"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Enable screensaver lock and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="screensaver lock delay is set correctly" test_ref="oval:ssg-test_screensaver_lock_delay:tst:1"/>
          <criterion comment="prevent user from changing screensaver lock delay" test_ref="oval:ssg-test_prevent_user_lock_delay:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" version="2">
      <metadata>
        <title>Enable GNOME3 Screensaver Lock After Idle Period</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Idle activation of the screen lock should be enabled.</description>
      <reference source="ssg" ref_id="dconf_gnome_screensaver_lock_enabled"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Enable screensaver lock and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="screensaver lock is enabled" test_ref="oval:ssg-test_screensaver_lock_enabled:tst:1"/>
          <criterion comment="screensaver lock prevent user from changing" test_ref="oval:ssg-test_prevent_user_screensaver_lock:tst:1"/>
          <criterion comment="screensaver lock delay is set correctly" test_ref="oval:ssg-test_screensaver_lock_delay:tst:1"/>
          <criterion comment="prevent user from changing screensaver lock delay" test_ref="oval:ssg-test_prevent_user_lock_delay:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" version="2">
      <metadata>
        <title>Implement Blank Screensaver</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The GNOME3 screensaver should be blank.</description>
      <reference source="ssg" ref_id="dconf_gnome_screensaver_mode_blank"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Enable blank screensaver and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="screensaver is blank" test_ref="oval:ssg-test_screensaver_mode_blank:tst:1"/>
          <criterion comment="screensaver prevent user from changing mode" test_ref="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_user_info:def:1" version="1">
      <metadata>
        <title>Disable Full User Name on Splash Shield</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>GNOME3 screen splash shield should not display full name of logged in user.</description>
      <reference source="ssg" ref_id="dconf_gnome_screensaver_user_info"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="Disable screensaver user info and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="screensaver user info is disabled" test_ref="oval:ssg-test_screensaver_disable_user_info:tst:1"/>
          <criterion comment="screensaver prevent user from changing" test_ref="oval:ssg-test_prevent_user_info_change:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dconf_gnome_session_user_locks:def:1" version="1">
      <metadata>
        <title>Ensure Users Cannot Change GNOME3 Session Settings</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Ensure that users cannot change GNOME3 session idle and lock settings.</description>
      <reference source="ssg" ref_id="dconf_gnome_session_user_locks"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
        <criteria comment="check screensaver idle delay and prevent user from changing it" operator="AND">
          <extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
          <criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_user_change_idle_delay_lock:tst:1"/>
          <criterion comment="prevent user from changing screensaver lock delay" test_ref="oval:ssg-test_user_change_lock_delay_lock:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dir_perms_etc_httpd_conf:def:1" version="2">
      <metadata>
        <title>Directory /etc/httpd/conf/ Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Directory permissions for /etc/httpd/conf/ should be set to 0750 (or stronger).</description>
      <reference source="ssg" ref_id="dir_perms_etc_httpd_conf"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="httpd not present or in use" definition_ref="oval:ssg-package_httpd_removed:def:1"/>
        <criterion test_ref="oval:ssg-test_dir_perms_etc_httpd_conf:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dir_perms_var_log_httpd:def:1" version="2">
      <metadata>
        <title>Directory /var/log/httpd/ Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Directory permissions for /var/log/httpd should be set to 0700 (or stronger).</description>
      <reference source="ssg" ref_id="dir_perms_var_log_httpd"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="httpd not present or in use" definition_ref="oval:ssg-package_httpd_removed:def:1"/>
        <criterion test_ref="oval:ssg-test_dir_perms_var_log_httpd:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" version="1">
      <metadata>
        <title>Verify that All World-Writable Directories Have Sticky Bits Set</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The sticky bit should be set for all world-writable directories.</description>
      <reference source="ssg" ref_id="dir_perms_world_writable_sticky_bits"/></metadata>
      <criteria>
        <criterion comment="all local world writable directories have sticky bit set" test_ref="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-dir_perms_world_writable_system_owned:def:1" version="1">
      <metadata>
        <title>Find world writable directories not owned by a system account</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>All world writable directories should be owned by a system user.</description>
      <reference source="ssg" ref_id="dir_perms_world_writable_system_owned"/></metadata>
      <criteria comment="check for local directories that are world writable and have uid greater than or equal to 1000" negate="true">
        <criterion comment="check for local directories that are world writable and have uid greater than or equal to 1000" test_ref="oval:ssg-test_dir_world_writable_uid_gt_1000:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-disable_host_auth:def:1" version="2">
      <metadata>
        <title>Disable Host-Based Authentication</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>SSH host-based authentication should be disabled.</description>
      <reference source="ssg" ref_id="disable_host_auth"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check HostbasedAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_hostbasedauthentication:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-disable_interactive_boot:def:1" version="4">
      <metadata>
        <title>Verify that Interactive Boot is Disabled</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The ability for users to perform interactive startups should
      be disabled.</description>
      <reference source="ssg" ref_id="disable_interactive_boot"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_disable_interactive_boot_grub_cmdline_linux:tst:1" comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX"/>
        <criteria operator="AND">
          <criterion test_ref="oval:ssg-test_disable_interactive_boot_grub_cmdline_linux_default:tst:1" comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX_DEFAULT"/>
          <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-disable_prelink:def:1" version="3">
      <metadata>
        <title>Disable Prelinking</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
        </affected>
        <description>The prelinking feature can interfere with the operation of
      checksum integrity tools (e.g. AIDE), mitigates the protection provided
      by ASLR, and requires additional CPU cycles by software upgrades.
      </description>
      <reference source="ssg" ref_id="disable_prelink"/></metadata>
      <criteria operator="OR" comment="Conditions for prelinking disabled are satisfied">
        <!-- Part for testing RHEL-6 system -->
        <!-- On RHEL6 system the prelink RPM package is installed by default -->
        <criteria operator="AND" comment="System is RHEL6 with prelinking disabled">
          <extend_definition comment="Installed OS is RHEL6" definition_ref="oval:ssg-installed_OS_is_rhel6:def:1"/>
          <criterion comment="Prelinking is disabled" test_ref="oval:ssg-test_prelinking_disabled:tst:1"/>
        </criteria>
        <!-- Part for testing RHEL-7 or Fedora system -->
        <!-- On RHEL7 and Fedora systems the prelink RPM package is *not* installed by default -->
        <criteria operator="AND" comment="System is RHEL7 or Fedora and prelink RPM is not installed or prelinking is disabled">
          <criteria operator="OR" comment="System is RHEL7 or Fedora">
            <extend_definition comment="Installed OS is RHEL7" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <extend_definition comment="Installed OS is Fedora" definition_ref="oval:ssg-installed_OS_is_fedora:def:1"/>
          </criteria>
          <criteria operator="OR" comment="prelink RPM package not installed or prelinking disabled">
            <extend_definition comment="prelink RPM package not installed" definition_ref="oval:ssg-package_prelink_removed:def:1"/>
            <criterion comment="Prelinking is disabled" test_ref="oval:ssg-test_prelinking_disabled:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-disable_users_coredumps:def:1" version="1">
      <metadata>
        <title>Disable Core Dumps</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Core dumps for all users should be disabled</description>
      <reference source="ssg" ref_id="disable_users_coredumps"/></metadata>
      <criteria>
        <criterion comment="Are core dumps disabled" test_ref="oval:ssg-test_core_dumps_limitsconf:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-display_login_attempts:def:1" version="1">
      <metadata>
        <title>Set Last Login/Access Notification</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Configure the system to notify users of last login/access using pam_lastlog.</description>
      <reference source="ssg" ref_id="display_login_attempts"/></metadata>
      <criteria>
        <criterion comment="Conditions for pam_lastlog are satisfied" test_ref="oval:ssg-test_display_login_attempts:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-enable_dconf_user_profile:def:1" version="1">
      <metadata>
        <title>Implement Local DB for DConf User Profile</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The DConf User profile should have the local DB configured.</description>
      <reference source="ssg" ref_id="enable_dconf_user_profile"/></metadata>
      <criteria>
        <criterion comment="dconf user profile exists" test_ref="oval:ssg-test_dconf_user_profile:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-enable_selinux_bootloader:def:1" version="1">
      <metadata>
        <title>Enable SELinux in the GRUB2 Bootloader"</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>
        Check if selinux=0 OR enforcing=0 within the GRUB2 configuration files, fail if found.
      </description>
      <reference source="ssg" ref_id="enable_selinux_bootloader"/></metadata>
      <criteria operator="AND">
        <criterion comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found" test_ref="oval:ssg-test_selinux_default_grub:tst:1"/>
        <criterion comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found" test_ref="oval:ssg-test_selinux_grub2_cfg:tst:1"/>
        <criterion comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found" test_ref="oval:ssg-test_selinux_grub_dir:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_gpgcheck_globally_activated:def:1" version="1">
      <metadata>
        <title>Ensure Yum gpgcheck Globally Activated</title>
        <affected family="unix">
        </affected>
        <description>The gpgcheck option should be used to ensure that checking
      of an RPM package's signature always occurs prior to its
      installation.</description>
      <reference source="ssg" ref_id="ensure_gpgcheck_globally_activated"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <extend_definition comment="Fedora installed" definition_ref="oval:ssg-installed_OS_is_fedora:def:1"/>
          <criterion comment="check value of gpgcheck in /etc/dnf/dnf.conf" test_ref="oval:ssg-test_dnf_ensure_gpgcheck_globally_activated:tst:1"/>
        </criteria>
        <criterion comment="check value of gpgcheck in /etc/yum.conf" test_ref="oval:ssg-test_yum_ensure_gpgcheck_globally_activated:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_gpgcheck_never_disabled:def:1" version="1">
      <metadata>
        <title>Ensure gpgcheck Enabled For All Yum or Dnf Package Repositories</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
        </affected>
        <description>Ensure all yum or dnf repositories utilize signature checking.</description>
      <reference source="ssg" ref_id="ensure_gpgcheck_never_disabled"/></metadata>
      <criteria comment="ensure all yum or dnf repositories utilize signiature checking" operator="AND">
        <criterion comment="verify no gpgpcheck=0 present in /etc/yum.repos.d files" test_ref="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_logrotate_activated:def:1" version="1">
      <metadata>
        <title>Ensure the logrotate utility performs the automatic rotation of log files on daily basis</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>
      The frequency of automatic log files rotation performed by the logrotate utility should be configured to run daily
      </description>
      <reference source="ssg" ref_id="ensure_logrotate_activated"/></metadata>
      <criteria comment="/etc/logrotate.conf contains daily setting or /etc/cron.daily/logrotate file exists" operator="OR">
        <criterion comment="Check if daily is set in /etc/logrotate.conf" test_ref="oval:ssg-test_logrotate_conf_daily_setting:tst:1"/>
        <criterion comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)" test_ref="oval:ssg-test_cron_daily_logrotate_existence:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ensure_redhat_gpgkey_installed:def:1" version="2">
      <metadata>
        <title>Red Hat Release and Auxiliary gpg-pubkey Packages Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The Red Hat release and auxiliary key packages are required to be installed.</description>
      <reference source="ssg" ref_id="ensure_redhat_gpgkey_installed"/></metadata>
      <criteria comment="Vendor GPG keys" operator="OR">
        <criteria comment="Red Hat Vendor Keys" operator="AND">
          <criteria comment="Red Hat Installed" operator="OR">
            <extend_definition comment="RHEL6 installed" definition_ref="oval:ssg-installed_OS_is_rhel6:def:1"/>
            <extend_definition comment="RHEL7 installed" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
          </criteria>
          <criterion comment="package gpg-pubkey-fd431d51-4ae0493b is installed" test_ref="oval:ssg-test_package_gpgkey-fd431d51-4ae0493b_installed:tst:1"/>
          <criterion comment="package gpg-pubkey-2fa658e0-45700c69 is installed" test_ref="oval:ssg-test_package_gpgkey-2fa658e0-45700c69_installed:tst:1"/>
        </criteria>
        <criteria comment="CentOS Vendor Keys" operator="OR">
          <criteria comment="CentOS Installed" operator="OR">
            <extend_definition comment="CentOS6 installed" definition_ref="oval:ssg-installed_OS_is_centos6:def:1"/>
            <extend_definition comment="CentOS7 installed" definition_ref="oval:ssg-installed_OS_is_centos7:def:1"/>
          </criteria>
          <criterion comment="package gpg-pubkey-f4a80eb5-53a7ff4b is installed" test_ref="oval:ssg-test_package_gpgkey-f4a80eb5-53a7ff4b_installed:tst:1"/>
          <criterion comment="package gpg-pubkey-c105b9de-4e0fd3a3 is installed" test_ref="oval:ssg-test_package_gpgkey-c105b9de-4e0fd3a3_installed:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_group_owner_grub2_cfg:def:1" version="1">
      <metadata>
        <title>File grub.cfg Owned By root Group </title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The grub.cfg file should be owned by the root group. By default, this file is located at /boot/grub2/grub.cfg or, for EFI systems, at /boot/efi/EFI/redhat/grub.cfg</description>
      <reference source="ssg" ref_id="file_group_owner_grub2_cfg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_file_group_owner_grub2_cfg:tst:1"/>
        <criterion test_ref="oval:ssg-test_file_group_owner_efi_grub2_cfg:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_groupowner_etc_group:def:1" version="1">
      <metadata>
        <title>Verify group who owns 'group' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/group file should be owned by the appropriate
      group.</description>
      <reference source="ssg" ref_id="file_groupowner_etc_group"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_groupowner_etc_group:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_groupowner_etc_gshadow:def:1" version="1">
      <metadata>
        <title>Verify group who owns 'gshadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/gshadow file should be owned by the appropriate
      group.</description>
      <reference source="ssg" ref_id="file_groupowner_etc_gshadow"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_groupowner_etc_gshadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_groupowner_etc_passwd:def:1" version="1">
      <metadata>
        <title>Verify group who owns 'passwd' file</title>
        <affected family="unix">
          <platform>SUSE Linux Enterprise 12</platform>
          <platform>SUSE Linux Enterprise 11</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/passwd file should be owned by the appropriate
      group.</description>
      <reference source="ssg" ref_id="file_groupowner_etc_passwd"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_groupowner_etc_passwd:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_owner_etc_group:def:1" version="1">
      <metadata>
        <title>Verify user who owns 'group' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/group file should be owned by the appropriate
      user.</description>
      <reference source="ssg" ref_id="file_owner_etc_group"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_owner_etc_group:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_owner_etc_gshadow:def:1" version="1">
      <metadata>
        <title>Verify user who owns 'gshadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/gshadow file should be owned by the appropriate
      user.</description>
      <reference source="ssg" ref_id="file_owner_etc_gshadow"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_owner_etc_gshadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_owner_etc_passwd:def:1" version="1">
      <metadata>
        <title>Verify user who owns 'passwd' file</title>
        <affected family="unix">
          <platform>SUSE Linux Enterprise 12</platform>
          <platform>SUSE Linux Enterprise 11</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/passwd file should be owned by the appropriate
      user.</description>
      <reference source="ssg" ref_id="file_owner_etc_passwd"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_owner_etc_passwd:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_ownership_binary_dirs:def:1" version="2">
      <metadata>
        <title>Verify that System Executables Have Root Ownership</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>
        Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
        /usr/local/sbin, /usr/libexec, and objects therein, are owned by root.
      </description>
      <reference source="ssg" ref_id="file_ownership_binary_dirs"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_ownership_binary_directories:tst:1"/>
        <criterion test_ref="oval:ssg-test_ownership_binary_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_ownership_library_dirs:def:1" version="1">
      <metadata>
        <title>Verify that Shared Library Files Have Root Ownership</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        objects therein, are owned by root.
      </description>
      <reference source="ssg" ref_id="file_ownership_library_dirs"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_ownership_lib_dir:tst:1"/>
        <criterion test_ref="oval:ssg-test_ownership_lib_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_ownership_var_log_audit:def:1" version="3">
      <metadata>
        <title>Verify /var/log/audit Ownership</title>
        <affected family="unix">
        </affected>
        <description>Checks that all /var/log/audit files and directories are owned by the root user and group.</description>
      <reference source="ssg" ref_id="file_ownership_var_log_audit"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND" comment="directories are root owned">
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files:tst:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories:tst:1"/>
        </criteria>
        <criteria operator="AND" comment="log_group in auditd.conf is not root">
          <extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1"/>
          <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_binary_dirs:def:1" version="2">
      <metadata>
        <title>Verify that System Executables Have Restrictive Permissions</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>
        Checks that binary files under /bin, /sbin, /usr/bin, /usr/sbin,
        /usr/local/bin, /usr/local/sbin, and /usr/libexec are not group-writable or world-writable.
      </description>
      <reference source="ssg" ref_id="file_permissions_binary_dirs"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_perms_binary_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_group:def:1" version="2">
      <metadata>
        <title>Verify permissions on 'group' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>File permissions for /etc/group should be set
      correctly.</description>
      <reference source="ssg" ref_id="file_permissions_etc_group"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_permissions_etc_group:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_gshadow:def:1" version="1">
      <metadata>
        <title>Verify /etc/gshadow Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>This test makes sure that /etc/gshadow is owned by 0, group owned by 0, and has mode 0000. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference source="ssg" ref_id="file_permissions_etc_gshadow"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_gshadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_passwd:def:1" version="2">
      <metadata>
        <title>Verify /etc/passwd Permissions</title>
        <affected family="unix">
          <platform>SUSE Linux Enterprise 12</platform>
          <platform>SUSE Linux Enterprise 11</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>This test makes sure that /etc/passwd is owned by 0, group owned by 0, and has mode 0644 (or stronger). If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference source="ssg" ref_id="file_permissions_etc_passwd"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_passwd:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_etc_shadow:def:1" version="1">
      <metadata>
        <title>Verify /etc/shadow Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>This test makes sure that /etc/shadow is owned by 0, group owned by 0, and has mode 0000. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference source="ssg" ref_id="file_permissions_etc_shadow"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_etc_shadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_grub2_cfg:def:1" version="1">
      <metadata>
        <title>File grub.cfg Permissions</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>File permissions for grub.cfg should be set to 0600 (or stronger). By default, this file is located at /boot/grub2/grub.cfg or, for EFI systems, at /boot/efi/EFI/redhat/grub.cfg</description>
      <reference source="ssg" ref_id="file_permissions_grub2_cfg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_file_permissions_grub2_cfg:tst:1"/>
        <criterion test_ref="oval:ssg-test_file_permissions_efi_grub2_cfg:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_home_dirs:def:1" version="1">
      <metadata>
        <title>Proper Permissions User Home Directories</title>
        <affected family="unix">
        </affected>
        <description>File permissions should be set correctly for the home directories for all user accounts.</description>
      <reference source="ssg" ref_id="file_permissions_home_dirs"/></metadata>
      <criteria>
        <criterion comment="home directories" test_ref="oval:ssg-test_file_permissions_home_dirs:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_httpd_server_conf_files:def:1" version="2">
      <metadata>
        <title>Verify Permissions On Apache Web Server Configuration Files</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/httpd/conf/* files should have the appropriate permissions (0640 or stronger).</description>
      <reference source="ssg" ref_id="file_permissions_httpd_server_conf_files"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="httpd not present or in use" definition_ref="oval:ssg-package_httpd_removed:def:1"/>
        <criterion test_ref="oval:ssg-test_file_permissions_httpd_server_conf_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_library_dirs:def:1" version="1">
      <metadata>
        <title>Verify that Shared Library Files Have Restrictive Permissions</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        objects therein, are not group-writable or world-writable.
      </description>
      <reference source="ssg" ref_id="file_permissions_library_dirs"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_perms_lib_dir:tst:1"/>
        <criterion test_ref="oval:ssg-test_perms_lib_files:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_unauthorized_world_writable:def:1" version="1">
      <metadata>
        <title>Find Unauthorized World-Writable Files</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The world-write permission should be disabled for all files.</description>
      <reference source="ssg" ref_id="file_permissions_unauthorized_world_writable"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_ungroupowned:def:1" version="2">
      <metadata>
        <title>Find files unowned by a group</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
        </affected>
        <description>All files should be owned by a group</description>
      <reference source="ssg" ref_id="file_permissions_ungroupowned"/></metadata>
      <criteria>
        <criterion comment="Check all files and make sure they are owned by a group" test_ref="oval:ssg-test_file_permissions_ungroupowned:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_permissions_var_log_audit:def:1" version="2">
      <metadata>
        <title>Verify /var/log/audit Permissions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Checks for correct permissions for all log files in /var/log/audit.</description>
      <reference source="ssg" ref_id="file_permissions_var_log_audit"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit:tst:1" negate="true"/>
        <criteria operator="AND" comment="log_group in auditd.conf is not root">
          <extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
          <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" negate="true"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-file_user_owner_grub2_cfg:def:1" version="1">
      <metadata>
        <title>File grub.cfg Owned By root User</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The grub.cfg file should be owned by the root user. By default, this file is located at /boot/grub2/grub.cfg or, for EFI systems, at /boot/efi/EFI/redhat/grub.cfg</description>
      <reference source="ssg" ref_id="file_user_owner_grub2_cfg"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_file_user_owner_grub2_cfg:tst:1"/>
        <criterion test_ref="oval:ssg-test_file_user_owner_efi_grub2_cfg:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-firewalld_sshd_disabled:def:1" version="1">
      <metadata>
        <title>Disallow inbound firewall access to the SSH Server port</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>If inbound SSH access is not needed, the firewall should disallow or reject access to
      the SSH port (22).</description>
      <reference source="ssg" ref_id="firewalld_sshd_disabled"/></metadata>
      <criteria operator="AND">
        <criterion comment="ssh service is not enabled in services" test_ref="oval:ssg-test_firewalld_service_sshd:tst:1"/>
        <criterion comment="ssh port is not enabled in services" test_ref="oval:ssg-test_firewalld_service_sshd_port:tst:1"/>
        <criterion comment="ssh service is not enabled in zones" test_ref="oval:ssg-test_firewalld_zone_sshd:tst:1"/>
        <criterion comment="ssh port is not enabled in zones" test_ref="oval:ssg-test_firewalld_zone_sshd_port:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-firewalld_sshd_port_enabled:def:1" version="1">
      <metadata>
        <title>Allow inbound firewall access to the SSH Server port</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>If inbound SSH access is needed, the firewall should allow access to
      the SSH port (22).</description>
      <reference source="ssg" ref_id="firewalld_sshd_port_enabled"/></metadata>
      <criteria operator="OR">
        <criterion comment="ssh service is enabled in services" test_ref="oval:ssg-test_firewalld_service_sshd_enabled:tst:1"/>
        <criterion comment="ssh port is enabled in services" test_ref="oval:ssg-test_firewalld_service_sshd_port_enabled:tst:1"/>
        <criterion comment="ssh service is enabled in zones" test_ref="oval:ssg-test_firewalld_zone_sshd_enabled:tst:1"/>
        <criterion comment="ssh port is enabled in zones" test_ref="oval:ssg-test_firewalld_zone_sshd_port_enabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ftp_log_transactions:def:1" version="1">
      <metadata>
        <title>Banner for FTP Users</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
        </affected>
        <description>To trace malicious activity facilitated by the FTP 
      service, it must be configured to ensure that all commands sent to 
      the FTP server are logged using the verbose vsftpd log format.
      </description>
      <reference source="ssg" ref_id="ftp_log_transactions"/></metadata>
      <criteria comment="FTP is not being used or the conditions are met" operator="OR">
        <extend_definition comment="vsftp package is not installed" definition_ref="oval:ssg-package_vsftpd_installed:def:1" negate="true"/>
        <criteria comment="FTP configuration conditions are not set or are met" operator="AND">
          <criterion comment="log ftp transactions enable" test_ref="oval:ssg-test_ftp_log_transactions_enable:tst:1"/>
          <criterion comment="log ftp transactions format" test_ref="oval:ssg-test_ftp_log_transactions_format:tst:1"/>
          <criterion comment="log ftp transactions protocol" test_ref="oval:ssg-test_ftp_log_transactions_protocol:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ftp_present_banner:def:1" version="1">
      <metadata>
        <title>Banner for FTP Users</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
        </affected>
        <description>This setting will cause the system greeting banner to be 
      used for FTP connections as well.</description>
      <reference source="ssg" ref_id="ftp_present_banner"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="vsftpd package is not installed" negate="true" definition_ref="oval:ssg-package_vsftpd_installed:def:1"/>
        <criterion comment="Banner for FTP Users" test_ref="oval:ssg-test_ftp_present_banner:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gid_passwd_group_same:def:1" version="2">
      <metadata>
        <title>All GIDs Are Present In /etc/group</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>All GIDs referenced in /etc/passwd must be defined in /etc/group.</description>
      <reference source="ssg" ref_id="gid_passwd_group_same"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_gid_passwd_group_same:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gnome_gdm_disable_automatic_login:def:1" version="2">
      <metadata>
        <title>Disable GDM Automatic Login</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable the GNOME Display Manager (GDM) ability to allow users to
      automatically login.</description>
      <reference source="ssg" ref_id="gnome_gdm_disable_automatic_login"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true"/>
        <criterion comment="Disable GDM Automatic Login" test_ref="oval:ssg-test_disable_automatic_login:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-gnome_gdm_disable_guest_login:def:1" version="2">
      <metadata>
        <title>Disable GDM Guest Login</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disable the GNOME Display Manager (GDM) ability to allow guest users
      to login.</description>
      <reference source="ssg" ref_id="gnome_gdm_disable_guest_login"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true"/>
        <criterion comment="Disable GDM Guest Login" test_ref="oval:ssg-test_disable_guest_login:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-groupowner_shadow_file:def:1" version="2">
      <metadata>
        <title>Verify group who owns 'shadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>CentOS 4</platform>
          <platform>CentOS 5</platform>
          <platform>Red Hat Enterprise Linux 4</platform>
          <platform>Red Hat Enterprise Linux 5</platform>
        </affected>
        <description>The /etc/shadow file should be owned by the appropriate
      group.</description>
      <reference source="ssg" ref_id="groupowner_shadow_file"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_groupowner_etc_shadow:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_antivirus:def:1" version="1">
      <metadata>
        <title>Package Antivirus Installed</title>
        <affected family="unix">
        </affected>
        <description>Antivirus software should be installed.</description>
      <reference source="ssg" ref_id="install_antivirus"/></metadata>
      <criteria comment="Antivirus is not being used or conditions are met">
        <extend_definition comment="McAfee A/V Installed" definition_ref="oval:ssg-install_mcafee_antivirus:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_hids:def:1" version="1">
      <metadata>
        <title>Install Intrusion Detection Software</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Intrusion detection software or SELinux should be installed and enabled.</description>
      <reference source="ssg" ref_id="install_hids"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss:def:1"/>
        <criterion comment="SELinux enabled" test_ref="oval:ssg-test_selinux_enforcing:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_antivirus:def:1" version="1">
      <metadata>
        <title>Package McAfeeVSEForLinux Installed</title>
        <affected family="unix">
        </affected>
        <description>McAfee Antivirus software should be installed.</description>
      <reference source="ssg" ref_id="install_mcafee_antivirus"/></metadata>
      <criteria comment="Antivirus is not being used or conditions are met" operator="AND">
        <extend_definition comment="McAfee Runtime Libraries and Agent" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
        <criterion comment="Linuxshield AntiVirus package is installed" test_ref="oval:ssg-test_linuxshield_install_antivirus:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_cma_rt:def:1" version="1">
      <metadata>
        <title>Install the McAfee Runtime Libraries and Linux Agent</title>
        <affected family="unix">
        </affected>
        <description>Install the McAfee Runtime Libraries (MFErt) and Linux Agent (MFEcma).</description>
      <reference source="ssg" ref_id="install_mcafee_cma_rt"/></metadata>
      <criteria operator="AND">
        <criterion comment="McAfee runtime library package installed" test_ref="oval:ssg-test_mcafee_runtime_installed:tst:1"/>
        <criterion comment="McAfee management agent package installed" test_ref="oval:ssg-test_mcafee_management_agent:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss:def:1" version="1">
      <metadata>
        <title>Install McAfee Host-Based Intrusion Detection Software (HBSS)</title>
        <affected family="unix">
        </affected>
        <description>McAfee Host-Based Intrusion Detection Software (HBSS) software
      should be installed.</description>
      <reference source="ssg" ref_id="install_mcafee_hbss"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_accm:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_hips:def:1"/>
        <extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_pa:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_accm:def:1" version="1">
      <metadata>
        <title>Install the Asset Configuration Compliance Module (ACCM)</title>
        <affected family="unix">
        </affected>
        <description>Install the Asset Configuration Compliance Module (ACCM).</description>
      <reference source="ssg" ref_id="install_mcafee_hbss_accm"/></metadata>
      <criteria>
        <criterion comment="McAfee ACCM is installed" test_ref="oval:ssg-test_mcafee_accm_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_hips:def:1" version="1">
      <metadata>
        <title>Install the Host Intrusion Prevention System (HIPS) Module</title>
        <affected family="unix">
        </affected>
        <description>Install the McAfee Host Intrusion Prevention System (HIPS) Module if it is
      absolutely necessary. If SELinux is enabled, do not install or enable this module.</description>
      <reference source="ssg" ref_id="install_mcafee_hbss_hips"/></metadata>
      <criteria>
        <criterion comment="McAfee IPS  is installed" test_ref="oval:ssg-test_mcafee_hbss_hips_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-install_mcafee_hbss_pa:def:1" version="1">
      <metadata>
        <title>Install the Policy Auditor (PA) Module</title>
        <affected family="unix">
        </affected>
        <description>Install the Policy Auditor (PA) Module.</description>
      <reference source="ssg" ref_id="install_mcafee_hbss_pa"/></metadata>
      <criteria>
        <criterion comment="McAfee Policy Auditor is installed" test_ref="oval:ssg-test_mcafee_auditengine_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_centos6:def:1" version="2">
      <metadata>
        <title>CentOS 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:centos:centos:6" source="CPE"/>
        <description>The operating system installed on the system is
      CentOS 6</description>
      <reference source="ssg" ref_id="installed_OS_is_centos6"/></metadata>
      <criteria>
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="CentOS6 is installed" test_ref="oval:ssg-test_centos6:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_centos7:def:1" version="2">
      <metadata>
        <title>CentOS 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:centos:centos:7" source="CPE"/>
        <description>The operating system installed on the system is
      CentOS 7</description>
      <reference source="ssg" ref_id="installed_OS_is_centos7"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="CentOS7 is installed" test_ref="oval:ssg-test_centos7:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-installed_OS_is_certified:def:1" version="1">
      <metadata>
        <title>Vendor Certified Operating System</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The operating system installed on the system is
      a certified vendor operating system and meets government
      requirements/certifications such as FIPS, NIAP, etc.</description>
      <reference source="ssg" ref_id="installed_OS_is_certified"/></metadata>
      <criteria comment="Installed operating system is a certified operating system" operator="OR">
        <extend_definition comment="Installed OS is RHEL6" definition_ref="oval:ssg-installed_OS_is_rhel6:def:1"/>
        <extend_definition comment="Installed OS is RHEL7" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_fedora:def:1" version="3">
      <metadata>
        <title>Installed operating system is Fedora</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:fedoraproject:fedora:22" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:23" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:24" source="CPE"/>
        <reference ref_id="cpe:/o:fedoraproject:fedora:25" source="CPE"/>
        <description>The operating system installed on the system is Fedora</description>
      <reference source="ssg" ref_id="installed_OS_is_fedora"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="fedora-release RPM package is installed" test_ref="oval:ssg-test_fedora_release_rpm:tst:1"/>
        <criterion comment="CPE vendor is 'fedoraproject' and product is 'fedora'" test_ref="oval:ssg-test_fedora_vendor_product:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1">
      <metadata>
        <title>Installed operating system is part of the Unix family</title>
        <affected family="unix">
        </affected>
        <description>The operating system installed on the system is part of the Unix OS family</description>
      <reference source="ssg" ref_id="installed_OS_is_part_of_Unix_family"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_family:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_rhel6:def:1" version="2">
      <metadata>
        <title>Red Hat Enterprise Linux 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:redhat:enterprise_linux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Red Hat Enterprise Linux 6</description>
      <reference source="ssg" ref_id="installed_OS_is_rhel6"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criteria operator="OR">
          <criterion comment="RHEL 6 Workstation is installed" test_ref="oval:ssg-test_rhel_workstation:tst:1"/>
          <criterion comment="RHEL 6 Server is installed" test_ref="oval:ssg-test_rhel_server:tst:1"/>
          <criterion comment="RHEL 6 Compute Node is installed" test_ref="oval:ssg-test_rhel_computenode:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_rhel7:def:1" version="1">
      <metadata>
        <title>Red Hat Enterprise Linux 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:redhat:enterprise_linux:7" source="CPE"/>
        <description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</description>
      <reference source="ssg" ref_id="installed_OS_is_rhel7"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel7_unix_family:tst:1"/>
        <criteria operator="OR">
          <criterion comment="RHEL 7 Workstation is installed" test_ref="oval:ssg-test_rhel7_workstation:tst:1"/>
          <criterion comment="RHEL 7 Server is installed" test_ref="oval:ssg-test_rhel7_server:tst:1"/>
          <criterion comment="RHEL 7 Compute Node is installed" test_ref="oval:ssg-test_rhel7_computenode:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_sl6:def:1" version="2">
      <metadata>
        <title>Scientific Linux 6</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Scientific Linux 6</description>
      <reference source="ssg" ref_id="installed_OS_is_sl6"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Scientific Linux 6 is installed" test_ref="oval:ssg-test_sl6:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_sl7:def:1" version="2">
      <metadata>
        <title>Scientific Linux 7</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
        <description>The operating system installed on the system is
      Scientific Linux 7</description>
      <reference source="ssg" ref_id="installed_OS_is_sl7"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
        <criterion comment="Scientific Linux 7 is installed" test_ref="oval:ssg-test_sl7:tst:1"/>
      </criteria>
    </definition>
    <definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux:def:1" version="1">
      <metadata>
        <title>WRLinux</title>
        <affected family="unix">
        </affected>
        <reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
        <description>The operating system installed on the system is
      Wind River Linux</description>
      <reference source="ssg" ref_id="installed_OS_is_wrlinux"/></metadata>
      <criteria>
        <criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux:tst:1"/>
        <criterion comment="WRLinux is installed" test_ref="oval:ssg-test_wrlinux:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_dccp_disabled:def:1" version="1">
      <metadata>
        <title>Disable dccp Kernel Module</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel module dccp should be disabled.</description>
      <reference source="ssg" ref_id="kernel_module_dccp_disabled"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_dccp_disabled:tst:1" comment="kernel module dccp disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" comment="kernel module dccp disabled in /etc/modprobe.conf"/>
        <criterion test_ref="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" comment="kernel module dccp disabled in /etc/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" comment="kernel module dccp disabled in /run/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" comment="kernel module dccp disabled in /usr/lib/modules-load.d"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-kernel_module_usb-storage_disabled:def:1" version="1">
      <metadata>
        <title>Disable usb-storage Kernel Module</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel module usb-storage should be disabled.</description>
      <reference source="ssg" ref_id="kernel_module_usb-storage_disabled"/></metadata>
      <criteria operator="OR">
        <criterion test_ref="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.conf"/>
        <criterion test_ref="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" comment="kernel module usb-storage disabled in /etc/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" comment="kernel module usb-storage disabled in /run/modules-load.d"/>
        <criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ldap_client_start_tls:def:1" version="1">
      <metadata>
        <title>Configure LDAP to Use TLS for All Transactions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Require the use of TLS for ldap clients.</description>
      <reference source="ssg" ref_id="ldap_client_start_tls"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="nss-pam-ldapd not present or not in use" definition_ref="oval:ssg-package_nss-pam-ldapd_removed:def:1"/>
        <criterion comment="look for ssl start_tls in /etc/nslcd.conf" test_ref="oval:ssg-test_ldap_client_start_tls_ssl:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-ldap_client_tls_cacertpath:def:1" version="1">
      <metadata>
        <title>Configure LDAP CA Certificate Path</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Require the use of TLS for ldap clients.</description>
      <reference source="ssg" ref_id="ldap_client_tls_cacertpath"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="nss-pam-ldapd not present or in use" definition_ref="oval:ssg-package_nss-pam-ldapd_removed:def:1"/>
        <criterion comment="look for tls_cacertdir in /etc/nslcd.conf" test_ref="oval:ssg-test_ldap_client_tls_cacertdir:tst:1"/>
        <criterion comment="look for tls_cacertfile in /etc/nslcd.conf" test_ref="oval:ssg-test_ldap_client_tls_cacertfile:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-logwatch_configured_hostlimit:def:1" version="1">
      <metadata>
        <title>Ensure Logwatch HostLimit Configured</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Test if HostLimit line in logwatch.conf is set appropriately.</description>
      <reference source="ssg" ref_id="logwatch_configured_hostlimit"/></metadata>
      <criteria operator="AND">
        <criterion comment="Test value of HostLimit" test_ref="oval:ssg-test_logwatch_configured_hostlimit:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-logwatch_configured_splithosts:def:1" version="1">
      <metadata>
        <title>Ensure Logwatch SplitHosts Configured</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Check if SplitHosts line in logwatch.conf is set appropriately.</description>
      <reference source="ssg" ref_id="logwatch_configured_splithosts"/></metadata>
      <criteria>
        <criterion comment="Test value of SplitHosts" test_ref="oval:ssg-test_logwatch_configured_splithosts:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_dev_shm_nodev:def:1" version="1">
      <metadata>
        <title>Add nodev Option to /dev/shm</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Legitimate character and block devices should not exist
      within temporary directories like /dev/shm. The nodev mount option should
      be specified for /dev/shm.</description>
      <reference source="ssg" ref_id="mount_option_dev_shm_nodev"/></metadata>
      <criteria>
        <criterion comment="nodev on /dev/shm" test_ref="oval:ssg-test_nodev_dev_shm:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_dev_shm_noexec:def:1" version="1">
      <metadata>
        <title>Add noexec Option to /dev/shm</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>It can be dangerous to allow the execution of binaries from
      world-writable temporary storage directories such as /dev/shm. The noexec
      mount option prevents binaries from being executed out of
      /dev/shm.</description>
      <reference source="ssg" ref_id="mount_option_dev_shm_noexec"/></metadata>
      <criteria>
        <criterion comment="noexec on /dev/shm" test_ref="oval:ssg-test_noexec_dev_shm:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_dev_shm_nosuid:def:1" version="1">
      <metadata>
        <title>Add nosuid Option to /dev/shm</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nosuid mount option should be set for temporary storage
      partitions such as /dev/shm. The suid/sgid permissions should not be
      required in these world-writable directories.</description>
      <reference source="ssg" ref_id="mount_option_dev_shm_nosuid"/></metadata>
      <criteria>
        <criterion comment="nosuid on /dev/shm" test_ref="oval:ssg-test_nosuid_dev_shm:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1" version="1">
      <metadata>
        <title>Add nodev Option to Non-Root Local Partitions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nodev mount option prevents files from being interpreted
      as character or block devices. Legitimate character and block devices
      should exist in the /dev directory on the root partition or within chroot
      jails built for system services. All other locations should not allow
      character and block devices.</description>
      <reference source="ssg" ref_id="mount_option_nodev_nonroot_local_partitions"/></metadata>
      <criteria>
        <criterion comment="nodev on local filesystems" test_ref="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_nodev_remote_filesystems:def:1" version="1">
      <metadata>
        <title>Mount Remote Filesystems with nodev</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nodev option should be enabled for all NFS mounts in /etc/fstab.</description>
      <reference source="ssg" ref_id="mount_option_nodev_remote_filesystems"/></metadata>
      <criteria operator="XOR">
        <!-- these tests are designed to be mutually exclusive; either no nfs mounts exist in /etc/fstab -->
        <!-- or all of the nfs mounts defined in /etc/fstab have the nodev mount option specified -->
        <criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_no_nfs_defined_etc_fstab_nodev:tst:1"/>
        <criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_nfs_nodev_etc_fstab:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_nodev_removable_partitions:def:1" version="4">
      <metadata>
        <title>Add nodev Option to Removable Media Partitions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nodev mount option prevents files from being interpreted
      as character or block devices. Legitimate character and block devices
      should exist in the /dev directory on the root partition or within chroot
      jails built for system services. All other locations should not allow
      character and block devices.</description>
      <reference source="ssg" ref_id="mount_option_nodev_removable_partitions"/></metadata>
      <criteria operator="OR">
        <!-- First check if specified removable partition truly exists on the system. If not, don't check /etc/fstab & runtime configuration
           since there's no device to check against -->
        <extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
        <!-- Removable device exists. Check if it's CD/DVD drive. If so, verify that at least one from all of the possible its alternative
           names in /etc/fstab & runtime configuration are configured with 'nodev' option -->
        <criteria operator="AND">
          <extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
          <criterion test_ref="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nodev' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_nodev_runtime_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nodev' mount option in runtime configuration"/>
        </criteria>
        <!-- Removable device exists & isn't CD/DVD drive. Check the particular devices is configured with 'nodev' mount option in both
           /etc/fstab & runtime configuration -->
        <criteria operator="AND">
          <criterion test_ref="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nodev' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_nodev_runtime_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nodev' mount option in runtime configuration"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_noexec_removable_partitions:def:1" version="4">
      <metadata>
        <title>Add noexec Option to Removable Media Partitions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The noexec mount option prevents the direct execution of
      binaries on the mounted filesystem. Users should not be allowed to
      execute binaries that exist on partitions mounted from removable media
      (such as a USB key). The noexec option prevents code from being executed
      directly from the media itself, and may therefore provide a line of
      defense against certain types of worms or malicious code.</description>
      <reference source="ssg" ref_id="mount_option_noexec_removable_partitions"/></metadata>
      <criteria operator="OR">
        <!-- First check if specified removable partition truly exists on the system. If not, don't check /etc/fstab & runtime configuration
           since there's no device to check against -->
        <extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
        <!-- Removable device exists. Check if it's CD/DVD drive. If so, verify that at least one from all of the possible its alternative
           names in /etc/fstab & runtime configuration are configured with 'noexec' option -->
        <criteria operator="AND">
          <extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
          <criterion test_ref="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'noexec' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_noexec_runtime_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'noexec' mount option in runtime configuration"/>
        </criteria>
        <!-- Removable device exists & isn't CD/DVD drive. Check the particular devices is configured with 'noexec' mount option in both
           /etc/fstab & runtime configuration -->
        <criteria operator="AND">
          <criterion test_ref="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'noexec' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_noexec_runtime_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'noexec' mount option in runtime configuration"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_nosuid_remote_filesystems:def:1" version="1">
      <metadata>
        <title>Mount Remote Filesystems with nosuid</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nosuid option should be enabled for all NFS mounts in /etc/fstab.</description>
      <reference source="ssg" ref_id="mount_option_nosuid_remote_filesystems"/></metadata>
      <criteria operator="XOR">
        <!-- these tests are designed to be mutually exclusive; either no nfs mounts exist in /etc/fstab -->
        <!-- or all of the nfs mounts defined in /etc/fstab have the nosuid mount option specified -->
        <criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_no_nfs_defined_etc_fstab_nosuid:tst:1"/>
        <criterion comment="remote nfs filesystems" test_ref="oval:ssg-test_nfs_nosuid_etc_fstab:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_nosuid_removable_partitions:def:1" version="4">
      <metadata>
        <title>Add nosuid Option to Removable Media Partitions</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nosuid mount option prevents set-user-identifier (suid)
      and set-group-identifier (sgid) permissions from taking effect. These
      permissions allow users to execute binaries with the same permissions as
      the owner and group of the file respectively. Users should not be allowed
      to introduce suid and guid files into the system via partitions mounted
      from removeable media.</description>
      <reference source="ssg" ref_id="mount_option_nosuid_removable_partitions"/></metadata>
      <criteria operator="OR">
        <!-- First check if specified removable partition truly exists on the system. If not, don't check /etc/fstab & runtime configuration
           since there's no device to check against -->
        <extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
        <!-- Removable device exists. Check if it's CD/DVD drive. If so, verify that at least one from all of the possible its alternative
           names in /etc/fstab & runtime configuration are configured with 'nosuid' option -->
        <criteria operator="AND">
          <extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
          <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nosuid' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_nosuid_runtime_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nosuid' mount option in runtime configuration"/>
        </criteria>
        <!-- Removable device exists & isn't CD/DVD drive. Check the particular devices is configured with 'nosuid' mount option in both
           /etc/fstab & runtime configuration -->
        <criteria operator="AND">
          <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nosuid' mount option in /etc/fstab"/>
          <criterion test_ref="oval:ssg-test_nosuid_runtime_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nosuid' mount option in runtime configuration"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_smb_client_signing:def:1" version="1">
      <metadata>
        <title>Require Client SMB Packet Signing, if using
      mount.cifs</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Require packet signing of clients who mount
      Samba shares using the mount.cifs program (e.g., those who
      specify shares in /etc/fstab). To do so, ensure that signing
      options (either sec=krb5i or sec=ntlmv2i) are
      used.</description>
      <reference source="ssg" ref_id="mount_option_smb_client_signing"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND">
          <extend_definition comment="samba-common installed" definition_ref="oval:ssg-package_samba-common_installed:def:1"/>
          <criteria operator="OR">
            <criterion comment="check for no cifs in /etc/fstab" test_ref="oval:ssg-test_20340111:tst:1"/>
            <criterion comment="check for sec=krb5i or sec=ntlmv2i in /etc/fstab" test_ref="oval:ssg-test_20340112:tst:1"/>
          </criteria>
          <criteria operator="OR">
            <criterion comment="check for no cifs in /etc/mtab" test_ref="oval:ssg-test_20340113:tst:1"/>
            <criterion comment="check for sec=krb5i or sec=ntlmv2i in /etc/mtab" test_ref="oval:ssg-test_20340114:tst:1"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_tmp_nodev:def:1" version="1">
      <metadata>
        <title>Add nodev Option to /tmp</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Legitimate character and block devices should not exist
      within temporary directories like /tmp. The nodev mount option should be
      specified for /tmp.</description>
      <reference source="ssg" ref_id="mount_option_tmp_nodev"/></metadata>
      <criteria>
        <criterion comment="nodev on /tmp" test_ref="oval:ssg-test_nodev_tmp:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_tmp_noexec:def:1" version="1">
      <metadata>
        <title>Add noexec Option to /tmp</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>It can be dangerous to allow the execution of binaries from
      world-writable temporary storage directories such as /tmp. The noexec
      mount option prevents binaries from being executed out of
      /tmp.</description>
      <reference source="ssg" ref_id="mount_option_tmp_noexec"/></metadata>
      <criteria>
        <criterion comment="noexec on /tmp" test_ref="oval:ssg-test_noexec_tmp:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_tmp_nosuid:def:1" version="1">
      <metadata>
        <title>Add nosuid Option to /tmp</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The nosuid mount option should be set for temporary storage
      partitions such as /tmp. The suid/sgid permissions should not be required
      in these world-writable directories.</description>
      <reference source="ssg" ref_id="mount_option_tmp_nosuid"/></metadata>
      <criteria>
        <criterion comment="nosuid on /tmp" test_ref="oval:ssg-test_nosuid_tmp:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-mount_option_var_tmp_bind:def:1" version="1">
      <metadata>
        <title>Bind Mount /var/tmp To /tmp</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /var/tmp directory should be bind mounted to /tmp in
      order to consolidate temporary storage into one location protected by the
      same techniques as /tmp.</description>
      <reference source="ssg" ref_id="mount_option_var_tmp_bind"/></metadata>
      <criteria operator="AND">
        <criterion comment="Ensure /var/tmp is mounted" test_ref="oval:ssg-test_mount_option_var_tmp:tst:1"/>
        <criterion comment="Ensure /tmp is bind mounted" test_ref="oval:ssg-test_mount_option_var_tmp_bind:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_disable_zeroconf:def:1" version="1">
      <metadata>
        <title>Disable Zeroconf Networking</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable Zeroconf automatic route assignment in the
      169.254.0.0 subnet.</description>
      <reference source="ssg" ref_id="network_disable_zeroconf"/></metadata>
      <criteria>
        <criterion comment="Look for NOZEROCONF=yes in /etc/sysconfig/network" test_ref="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_ipv6_default_gateway:def:1" version="1">
      <metadata>
        <title>Manually Assign IPv6 Router Address</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Define default gateways for IPv6 traffic</description>
      <reference source="ssg" ref_id="network_ipv6_default_gateway"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
        <criterion comment="Define default gateways" test_ref="oval:ssg-test_network_ipv6_default_gateway:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_ipv6_disable_rpc:def:1" version="1">
      <metadata>
        <title>Disable Support for RPC IPv6</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable ipv6 based rpc services</description>
      <reference source="ssg" ref_id="network_ipv6_disable_rpc"/></metadata>
      <criteria operator="AND">
        <criterion comment="Disable udp6" test_ref="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1"/>
        <criterion comment="Disable tcp6" test_ref="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_ipv6_privacy_extensions:def:1" version="1">
      <metadata>
        <title>Enable Privacy Extensions for IPv6</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Enable privacy extensions for IPv6</description>
      <reference source="ssg" ref_id="network_ipv6_privacy_extensions"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
        <criterion comment="Enable privacy extensions per interface" test_ref="oval:ssg-test_network_ipv6_privacy_extensions:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_ipv6_static_address:def:1" version="1">
      <metadata>
        <title>Manually Assign Global IPv6 Address</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Manually configure addresses for IPv6</description>
      <reference source="ssg" ref_id="network_ipv6_static_address"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
        <criterion comment="Set static IPv6 address on each interface" test_ref="oval:ssg-test_network_ipv6_static_address:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-network_sniffer_disabled:def:1" version="1">
      <metadata>
        <title>Disable the network sniffer</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Disable the network sniffer</description>
      <reference source="ssg" ref_id="network_sniffer_disabled"/></metadata>
      <criteria>
        <criterion comment="promisc interfaces" test_ref="oval:ssg-test_promisc_interfaces:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_direct_root_logins:def:1" version="1">
      <metadata>
        <title>Direct root Logins Not Allowed</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root logins help ensure accountability for actions
      taken on the system using the root account.</description>
      <reference source="ssg" ref_id="no_direct_root_logins"/></metadata>
      <criteria operator="AND">
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_no_direct_root_logins:tst:1"/>
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_etc_securetty_exists:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_empty_passwords:def:1" version="1">
      <metadata>
        <title>No nullok Option in /etc/pam.d/system-auth</title>
        <affected family="unix">
        </affected>
        <description>The file /etc/pam.d/system-auth should not contain the nullok option</description>
      <reference source="ssg" ref_id="no_empty_passwords"/></metadata>
      <criteria>
        <criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="oval:ssg-test_no_empty_passwords:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_files_unowned_by_user:def:1" version="1">
      <metadata>
        <title>Find files unowned by a user</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All files should be owned by a user</description>
      <reference source="ssg" ref_id="no_files_unowned_by_user"/></metadata>
      <criteria>
        <criterion comment="Check all files and make sure they are owned by a user" test_ref="oval:ssg-no_files_unowned_by_user_test:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_insecure_locks_exports:def:1" version="1">
      <metadata>
        <title>Ensure insecure_locks is disabled</title>
        <affected family="unix">
        </affected>
        <description>Allowing insecure file locking could allow for sensitive 
      data to be viewed or edited by an unauthorized user.</description>
      <reference source="ssg" ref_id="no_insecure_locks_exports"/></metadata>
      <criteria>
        <criterion comment="Check for insecure NFS locks in /etc/exports" test_ref="oval:ssg-test_no_insecure_locks_exports:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_netrc_files:def:1" version="1">
      <metadata>
        <title>Verify No netrc Files Exist</title>
        <affected family="unix">
        </affected>
        <description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</description>
      <reference source="ssg" ref_id="no_netrc_files"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_no_netrc_files_home:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_rsh_trust_files:def:1" version="1">
      <metadata>
        <title>No Legacy .rhosts Or hosts.equiv Files</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>There should not be any .rhosts or hosts.equiv files on the system.</description>
      <reference source="ssg" ref_id="no_rsh_trust_files"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_no_rsh_trust_files_root:tst:1" negate="true"/>
        <criterion test_ref="oval:ssg-test_no_rsh_trust_files_home:tst:1" negate="true"/>
        <criterion test_ref="oval:ssg-test_no_rsh_trust_files_etc:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-no_shelllogin_for_systemaccounts:def:1" version="2">
      <metadata>
        <title>System Accounts Do Not Run a Shell</title>
        <affected family="unix">
        </affected>
        <description>The root account is the only system account that should have
      a login shell.</description>
      <reference source="ssg" ref_id="no_shelllogin_for_systemaccounts"/></metadata>
      <criteria operator="OR">
        <!-- If SYS_UID_MIN and SYS_UID_MAX is not defined in /etc/login.defs
           perform the check that all /etc/passwd entries having shell defined
           have UIDs outside the default <0, UID_MIN -1> range.
           If at least one UID with shell defined exists within that range,
           the requirement isn't met -->
        <criteria operator="AND">
          <criterion comment="Test SYS_UID_MIN not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1"/>
          <criterion comment="Test SYS_UID_MAX not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1"/>
          <criterion comment="Test shell defined for UID from &lt;0, UID_MIN -1&gt;" test_ref="oval:ssg-test_shell_defined_default_uid_range:tst:1"/>
        </criteria>
        <!-- If both SYS_UID_MIN and SYS_UID_MAX are defined in /etc/login.defs
           perform both checks:
           * That all /etc/passwd entries having shell defined have UIDs outside
           the range for reserved system accounts <0, SYS_UID_MIN> range,
           * That all /etc/passwd entries having shell defined have UIDs outside
           the range for dynamically allocated system accounts <SYS_UID_MIN, SYS_UID_MAX>
           If at least one UID with shell defined exists within some of the two
           ranges, the requirement isn't met -->
        <criteria operator="AND">
          <criterion comment="Test SYS_UID_MIN defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" negate="true"/>
          <criterion comment="Test SYS_UID_MAX defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" negate="true"/>
          <criterion comment="Test shell defined for reserved system UIDs" test_ref="oval:ssg-test_shell_defined_reserved_uid_range:tst:1"/>
          <criterion comment="Test shell defined for dynamically allocated system UIDs" test_ref="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_dracut-fips_installed:def:1" version="1">
      <metadata>
        <title>Package dracut-fips Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package dracut-fips should be installed.</description>
      <reference source="ssg" ref_id="package_dracut-fips_installed"/></metadata>
      <criteria>
        <extend_definition comment="Installed OS is certified" definition_ref="oval:ssg-installed_OS_is_certified:def:1"/>
        <criterion comment="package dracut-fips is installed" test_ref="oval:ssg-test_package_dracut-fips_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_gdm_installed:def:1" version="1">
      <metadata>
        <title>Package gdm Installed</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package gdm should be installed.</description>
      <reference source="ssg" ref_id="package_gdm_installed"/></metadata>
      <criteria>
        <criterion comment="package gdm is installed" test_ref="oval:ssg-test_package_gdm_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_libreswan_installed:def:1" version="1">
      <metadata>
        <title>Package libreswan Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package libreswan should be installed.</description>
      <reference source="ssg" ref_id="package_libreswan_installed"/></metadata>
      <criteria>
        <criterion comment="package libreswan is installed" test_ref="oval:ssg-test_package_libreswan_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_mcstrans_removed:def:1" version="1">
      <metadata>
        <title>Package mcstrans Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package mcstrans should be removed.</description>
      <reference source="ssg" ref_id="package_mcstrans_removed"/></metadata>
      <criteria>
        <criterion comment="package mcstrans is removed" test_ref="oval:ssg-test_package_mcstrans_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_nss-pam-ldapd_removed:def:1" version="1">
      <metadata>
        <title>Package nss-pam-ldapd Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The RPM package nss-pam-ldapd should be removed.</description>
      <reference source="ssg" ref_id="package_nss-pam-ldapd_removed"/></metadata>
      <criteria>
        <criterion comment="package nss-pam-ldapd is removed" test_ref="oval:ssg-test_package_nss-pam-ldapd_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_openldap-servers_removed:def:1" version="1">
      <metadata>
        <title>Package openldap-servers Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package openldap-servers should be removed.</description>
      <reference source="ssg" ref_id="package_openldap-servers_removed"/></metadata>
      <criteria>
        <criterion comment="package openldap-servers is removed" test_ref="oval:ssg-test_package_openldap-servers_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_prelink_removed:def:1" version="1">
      <metadata>
        <title>Package prelink Removed</title>
        <affected family="unix">
        </affected>
        <description>The RPM package prelink should be removed.</description>
      <reference source="ssg" ref_id="package_prelink_removed"/></metadata>
      <criteria>
        <criterion comment="package prelink is removed" test_ref="oval:ssg-test_package_prelink_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_rsh-server_removed:def:1" version="1">
      <metadata>
        <title>Package rsh-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package rsh-server should be removed.</description>
      <reference source="ssg" ref_id="package_rsh-server_removed"/></metadata>
      <criteria>
        <criterion comment="package rsh-server is removed" test_ref="oval:ssg-test_package_rsh-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_rsh_removed:def:1" version="1">
      <metadata>
        <title>Package rsh Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package rsh should be removed.</description>
      <reference source="ssg" ref_id="package_rsh_removed"/></metadata>
      <criteria>
        <criterion comment="package rsh is removed" test_ref="oval:ssg-test_package_rsh_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_rsyslog_installed:def:1" version="1">
      <metadata>
        <title>Package rsyslog Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package rsyslog should be installed.</description>
      <reference source="ssg" ref_id="package_rsyslog_installed"/></metadata>
      <criteria>
        <criterion comment="package rsyslog is installed" test_ref="oval:ssg-test_package_rsyslog_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_samba-common_installed:def:1" version="1">
      <metadata>
        <title>Package samba-common Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package samba-common should be installed.</description>
      <reference source="ssg" ref_id="package_samba-common_installed"/></metadata>
      <criteria>
        <criterion comment="package samba-common is installed" test_ref="oval:ssg-test_package_samba-common_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_samba-common_removed:def:1" version="1">
      <metadata>
        <title>Package samba-common Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package samba-common should be removed.</description>
      <reference source="ssg" ref_id="package_samba-common_removed"/></metadata>
      <criteria>
        <criterion comment="package samba-common is removed" test_ref="oval:ssg-test_package_samba-common_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_screen_installed:def:1" version="1">
      <metadata>
        <title>Package screen Installed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package screen should be installed.</description>
      <reference source="ssg" ref_id="package_screen_installed"/></metadata>
      <criteria>
        <criterion comment="package screen is installed" test_ref="oval:ssg-test_package_screen_installed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_sendmail_removed:def:1" version="1">
      <metadata>
        <title>Package sendmail Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package sendmail should be removed.</description>
      <reference source="ssg" ref_id="package_sendmail_removed"/></metadata>
      <criteria>
        <criterion comment="package sendmail is removed" test_ref="oval:ssg-test_package_sendmail_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_setroubleshoot_removed:def:1" version="1">
      <metadata>
        <title>Package setroubleshoot Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package setroubleshoot should be removed.</description>
      <reference source="ssg" ref_id="package_setroubleshoot_removed"/></metadata>
      <criteria>
        <criterion comment="package setroubleshoot is removed" test_ref="oval:ssg-test_package_setroubleshoot_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_talk-server_removed:def:1" version="2">
      <metadata>
        <title>Package talk-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package talk-server should be removed.</description>
      <reference source="ssg" ref_id="package_talk-server_removed"/></metadata>
      <criteria>
        <criterion comment="package talk-server is removed" test_ref="oval:ssg-test_package_talk-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_talk_removed:def:1" version="2">
      <metadata>
        <title>Package talk Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package talk should be removed.</description>
      <reference source="ssg" ref_id="package_talk_removed"/></metadata>
      <criteria>
        <criterion comment="package talk is removed" test_ref="oval:ssg-test_package_talk_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_telnet-server_removed:def:1" version="1">
      <metadata>
        <title>Package telnet-server Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package telnet-server should be removed.</description>
      <reference source="ssg" ref_id="package_telnet-server_removed"/></metadata>
      <criteria>
        <criterion comment="package telnet-server is removed" test_ref="oval:ssg-test_package_telnet-server_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_telnet_removed:def:1" version="1">
      <metadata>
        <title>Package telnet Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package telnet should be removed.</description>
      <reference source="ssg" ref_id="package_telnet_removed"/></metadata>
      <criteria>
        <criterion comment="package telnet is removed" test_ref="oval:ssg-test_package_telnet_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_tftp_removed:def:1" version="1">
      <metadata>
        <title>Package tftp Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package tftp should be removed.</description>
      <reference source="ssg" ref_id="package_tftp_removed"/></metadata>
      <criteria>
        <criterion comment="package tftp is removed" test_ref="oval:ssg-test_package_tftp_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_xorg-x11-server-common_removed:def:1" version="2">
      <metadata>
        <title>Package xorg-x11-server-common Removed</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package xorg-x11-server-common should be removed.</description>
      <reference source="ssg" ref_id="package_xorg-x11-server-common_removed"/></metadata>
      <criteria>
        <criterion comment="package xorg-x11-server-common is removed" test_ref="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-package_ypserv_removed:def:1" version="1">
      <metadata>
        <title>Package ypserv Removed</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The RPM package ypserv should be removed.</description>
      <reference source="ssg" ref_id="package_ypserv_removed"/></metadata>
      <criteria>
        <criterion comment="package ypserv is removed" test_ref="oval:ssg-test_package_ypserv_removed:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_home:def:1" version="1">
      <metadata>
        <title>Ensure /home Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>If user home directories will be stored locally, create a
      separate partition for /home. If /home will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
      <reference source="ssg" ref_id="partition_for_home"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_home_partition:tst:1" comment="/home on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_tmp:def:1" version="1">
      <metadata>
        <title>Ensure /tmp Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /tmp directory is a world-writable directory used for
      temporary file storage. Verify that it has its own partition or logical
      volume.</description>
      <reference source="ssg" ref_id="partition_for_tmp"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_tmp_partition:tst:1" comment="/tmp on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var:def:1" version="1">
      <metadata>
        <title>Ensure /var Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Ensuring that /var is mounted on its own partition enables
      the setting of more restrictive mount options, which is used as temporary
      storage by many program, particularly system services such as daemons. It
      is not uncommon for the /var directory to contain world-writable
      directories, installed by other software packages.</description>
      <reference source="ssg" ref_id="partition_for_var"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_partition:tst:1" comment="/var on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var_log:def:1" version="1">
      <metadata>
        <title>Ensure /var/log Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>System logs are stored in the /var/log directory. Ensure
      that it has its own partition or logical volume.</description>
      <reference source="ssg" ref_id="partition_for_var_log"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_log_partition:tst:1" comment="/var/log on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-partition_for_var_log_audit:def:1" version="1">
      <metadata>
        <title>Ensure /var/log/audit Located On Separate Partition</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Audit logs are stored in the /var/log/audit directory.
      Ensure that it has its own partition or logical volume. Make absolutely
      certain that it is large enough to store all audit logs that will be
      created by the auditing daemon.</description>
      <reference source="ssg" ref_id="partition_for_var_log_audit"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_log_audit_partition:tst:1" comment="/var/log/audit on own partition"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-postfix_server_banner:def:1" version="1">
      <metadata>
        <title>Configure Postfix Against Unnecessary Release of Information</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Protect against unnecessary release of information.</description>
      <reference source="ssg" ref_id="postfix_server_banner"/></metadata>
      <criteria operator="AND">
        <criterion comment="Limit release of information" test_ref="oval:ssg-test_postfix_server_banner:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-removable_partition_doesnt_exist:def:1" version="1">
      <metadata>
        <title>Device Files for Removable Media Partitions Does Not Exist on the System</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Verify if device file representing removable partitions
      exist on the system</description>
      <reference source="ssg" ref_id="removable_partition_doesnt_exist"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_removable_partition_doesnt_exist:tst:1" comment="Check if removable partition really exists on the system"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-require_singleuser_auth:def:1" version="1">
      <metadata>
        <title>Require Authentication for Single-User Mode</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The requirement for a password to boot into single-user mode
      should be configured correctly.</description>
      <reference source="ssg" ref_id="require_singleuser_auth"/></metadata>
      <criteria operator="AND">
        <criterion comment="Conditions are satisfied" test_ref="oval:ssg-test_require_rescue_service:tst:1"/>
        <criterion test_ref="oval:ssg-test_require_rescue_service_runlevel1:tst:1"/>
        <criterion test_ref="oval:ssg-test_no_custom_runlevel1_target:tst:1" negate="true"/>
        <criterion test_ref="oval:ssg-test_no_custom_rescue_service:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-require_smb_client_signing:def:1" version="1">
      <metadata>
        <title>Require Client SMB Packet Signing in smb.conf</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Require samba clients which use smb.conf, such as smbclient,
      to use packet signing. A Samba client should only communicate with
      servers who can support SMB packet signing.</description>
      <reference source="ssg" ref_id="require_smb_client_signing"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="package samba-common is not installed" definition_ref="oval:ssg-package_samba-common_removed:def:1"/>
        <criteria operator="AND">
          <extend_definition comment="samba-common installed" definition_ref="oval:ssg-package_samba-common_installed:def:1"/>
          <criterion comment="check for client signing = mandatory in /etc/samba/smb.conf" test_ref="oval:ssg-test_require_smb_client_signing:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-restrict_serial_port_logins:def:1" version="1">
      <metadata>
        <title>Restrict Serial Port Root Logins</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root login to serial port interfaces helps
      ensure accountability for actions taken on the system using the root
      account.</description>
      <reference source="ssg" ref_id="restrict_serial_port_logins"/></metadata>
      <criteria>
        <criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_serial_ports_etc_securetty:tst:1" negate="true"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-root_path_no_dot:def:1" version="2">
      <metadata>
        <title>Ensure that No Dangerous Directories Exist in Root's Path</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The environment variable PATH should be set correctly for
      the root user.</description>
      <reference source="ssg" ref_id="root_path_no_dot"/></metadata>
      <criteria comment="environment variable PATH contains dangerous path" operator="AND">
        <criterion comment="environment variable PATH starts with : or ." test_ref="oval:ssg-test_env_var_begins:tst:1"/>
        <criterion comment="environment variable PATH contains : twice in a row" test_ref="oval:ssg-test_env_var_contains_doublecolon:tst:1"/>
        <criterion comment="environment variable PATH contains . twice in a row" test_ref="oval:ssg-test_env_var_contains_doubleperiod:tst:1"/>
        <criterion comment="environment variable PATH ends with : or ." test_ref="oval:ssg-test_env_var_ends:tst:1"/>
        <criterion comment="environment variable PATH doesn't begin with a /" test_ref="oval:ssg-test_env_var_begins_slash:tst:1"/>
        <criterion comment="environment variable PATH doesn't contain relative paths" test_ref="oval:ssg-test_env_var_contains_relative_path:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rpm_verify_hashes:def:1" version="3">
      <metadata>
        <title>Verify File Hashes with RPM</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
        </affected>
        <description>Verify the RPM digests of system binaries using the RPM database.</description>
      <reference source="ssg" ref_id="rpm_verify_hashes"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_files_fail_md5_hash:tst:1" comment="verify file md5 hashes"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rpm_verify_permissions:def:1" version="3">
      <metadata>
        <title>Verify File Ownership And Permissions Using RPM</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Verify the integrity of installed packages
      by comparing the installed files with information about the
      files taken from the package metadata stored in the RPM
      database.</description>
      <reference source="ssg" ref_id="rpm_verify_permissions"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_verify_all_rpms_user_ownership:tst:1" comment="user ownership of all files matches local rpm database"/>
        <criterion test_ref="oval:ssg-test_verify_all_rpms_group_ownership:tst:1" comment="group ownership of all files matches local rpm database"/>
        <criterion test_ref="oval:ssg-test_verify_all_rpms_mode:tst:1" comment="mode of all files matches local rpm database"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_nolisten:def:1" version="2">
      <metadata>
        <title>Disable Rsyslogd from Accepting Remote Messages on Loghosts
      Only</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>rsyslogd should reject remote messages</description>
      <reference source="ssg" ref_id="rsyslog_nolisten"/></metadata>
      <criteria>
        <criterion comment="Conditions are satisfied" test_ref="oval:ssg-test_rsyslog_nolisten:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-rsyslog_remote_loghost:def:1" version="1">
      <metadata>
        <title>Send Logs to a Remote Loghost</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Syslog logs should be sent to a remote loghost</description>
      <reference source="ssg" ref_id="rsyslog_remote_loghost"/></metadata>
      <criteria operator="OR">
        <criterion comment="Remote logging set within /etc/rsyslog.conf" test_ref="oval:ssg-test_remote_rsyslog_conf:tst:1"/>
        <criterion comment="Remote logging set within /etc/rsyslog.d" test_ref="oval:ssg-test_remote_rsyslog_d:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-securetty_root_login_console_only:def:1" version="1">
      <metadata>
        <title>Restrict Virtual Console Root Logins</title>
        <affected family="unix">
        </affected>
        <description>Preventing direct root login to virtual console devices
      helps ensure accountability for actions taken on the system using the
      root account.</description>
      <reference source="ssg" ref_id="securetty_root_login_console_only"/></metadata>
      <criteria>
        <criterion comment="virtual consoles /etc/securetty" test_ref="oval:ssg-test_virtual_consoles_etc_securetty:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-selinux_all_devicefiles_labeled:def:1" version="1">
      <metadata>
        <title>Device Files Have Proper SELinux Context</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>All device files in /dev should be assigned an SELinux security context other than 'device_t'.</description>
      <reference source="ssg" ref_id="selinux_all_devicefiles_labeled"/></metadata>
      <criteria>
        <criterion comment="device_t in /dev" test_ref="oval:ssg-test_selinux_all_devicefiles_labeled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-selinux_confinement_of_daemons:def:1" version="1">
      <metadata>
        <title>Ensure No Daemons are Unconfined by SELinux</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 6</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Wind River Linux 8</platform>
        </affected>
        <description>All pids in /proc should be assigned an SELinux security context other than 'initrc_t'.</description>
      <reference source="ssg" ref_id="selinux_confinement_of_daemons"/></metadata>
      <criteria>
        <criterion comment="device_t in /dev" test_ref="oval:ssg-test_selinux_confinement_of_daemons:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-selinux_policytype:def:1" version="1">
      <metadata>
        <title>Enable SELinux</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The SELinux policy should be set appropriately.</description>
      <reference source="ssg" ref_id="selinux_policytype"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_selinux_policy:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-selinux_state:def:1" version="1">
      <metadata>
        <title>SELinux Enforcing</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The SELinux state should be enforcing the local policy.</description>
      <reference source="ssg" ref_id="selinux_state"/></metadata>
      <criteria operator="AND">
        <criterion comment="enforce is disabled" test_ref="oval:ssg-test_etc_selinux_config:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-set_firewalld_default_zone:def:1" version="2">
      <metadata>
        <title>Change the default firewalld zone to drop</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Change the default firewalld zone to drop.</description>
      <reference source="ssg" ref_id="set_firewalld_default_zone"/></metadata>
      <criteria>
        <criterion comment="Set default zone to drop" test_ref="oval:ssg-test_firewalld_input_drop:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" version="1">
      <metadata>
        <title>Set SHA512 Password Hashing Algorithm in /etc/libuser.conf</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password hashing algorithm should be set correctly in /etc/libuser.conf.</description>
      <reference source="ssg" ref_id="set_password_hashing_algorithm_libuserconf"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" version="2">
      <metadata>
        <title>Set SHA512 Password Hashing Algorithm in /etc/login.defs</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password hashing algorithm should be set correctly in /etc/login.defs.</description>
      <reference source="ssg" ref_id="set_password_hashing_algorithm_logindefs"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_etc_login_defs_encrypt_method:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" version="1">
      <metadata>
        <title>Set Password Hashing Algorithm in /etc/pam.d/system-auth</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The password hashing algorithm should be set correctly in /etc/pam.d/system-auth.</description>
      <reference source="ssg" ref_id="set_password_hashing_algorithm_systemauth"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_pam_unix_sha512:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-snmpd_not_default_password:def:1" version="2">
      <metadata>
        <title>SNMP default communities disabled</title>
        <affected family="unix">
        </affected>
        <description>SNMP default communities must be removed.</description>
      <reference source="ssg" ref_id="snmpd_not_default_password"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="SMNP installed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
        <criterion comment="SNMP communities" test_ref="oval:ssg-test_snmp_default_communities:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-snmpd_use_newer_protocol:def:1" version="2">
      <metadata>
        <title>SNMP use newer protocols</title>
        <affected family="unix">
        </affected>
        <description>SNMP version 1 and 2c must not be enabled.</description>
      <reference source="ssg" ref_id="snmpd_use_newer_protocol"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="SMNP installed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
        <criterion comment="SNMP protocols" test_ref="oval:ssg-test_snmp_versions:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_allow_only_protocol2:def:1" version="1">
      <metadata>
        <title>Ensure Only Protocol 2 Connections Allowed</title>
        <affected family="unix">
          <platform>Ubuntu 1604</platform>
          <platform>Debian 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The OpenSSH daemon should be running protocol 2.</description>
      <reference source="ssg" ref_id="sshd_allow_only_protocol2"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
        <criterion comment="Check Protocol in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_allow_only_protocol2:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_empty_passwords:def:1" version="1">
      <metadata>
        <title>Disable Empty Passwords</title>
        <affected family="unix">
        </affected>
        <description>Remote connections from accounts with empty passwords should
      be disabled (and dependencies are met)</description>
      <reference source="ssg" ref_id="sshd_disable_empty_passwords"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check PermitEmptyPasswords in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_permitemptypasswords_no:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_rhosts:def:1" version="1">
      <metadata>
        <title>Disable .rhosts Files</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Emulation of the rsh command through the ssh server should
      be disabled (and dependencies are met)</description>
      <reference source="ssg" ref_id="sshd_disable_rhosts"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check IgnoreRhosts in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_rsh_emulation_disabled:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_rhosts_rsa:def:1" version="1">
      <metadata>
        <title>Disable SSH Support for Rhosts RSA Authentication</title>
        <affected family="unix">
        </affected>
        <description>SSH can allow authentication through the obsolete rsh command
      through the use of the authenticating user's SSH keys. This should be disabled.</description>
      <reference source="ssg" ref_id="sshd_disable_rhosts_rsa"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check RhostsRSAAuthentication in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_root_login:def:1" version="1">
      <metadata>
        <title>Disable root Login via SSH</title>
        <affected family="unix">
        </affected>
        <description>Root login via SSH should be disabled (and dependencies are
      met)</description>
      <reference source="ssg" ref_id="sshd_disable_root_login"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check PermitRootLogin in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_permitrootlogin_no:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_disable_user_known_hosts:def:1" version="1">
      <metadata>
        <title>Disable SSH Support for User Known Hosts</title>
        <affected family="unix">
        </affected>
        <description>SSH can allow system users host-based authentication
to connect to systems if a cache of the remote systems public keys are available.
This should be disabled.</description>
      <reference source="ssg" ref_id="sshd_disable_user_known_hosts"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check IgnoreUserKnownHosts in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_user_known_hosts:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_do_not_permit_user_env:def:1" version="1">
      <metadata>
        <title>Do Not Allow Users to Set Environment Options</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>PermitUserEnvironment should be disabled</description>
      <reference source="ssg" ref_id="sshd_do_not_permit_user_env"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check PermitUserEnvironment in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_no_user_envset:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_enable_warning_banner:def:1" version="1">
      <metadata>
        <title>Enable a Warning Banner</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>SSH warning banner should be enabled (and dependencies are
      met)</description>
      <reference source="ssg" ref_id="sshd_enable_warning_banner"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check Banner in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_banner_set:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_set_idle_timeout:def:1" version="1">
      <metadata>
        <title>Set OpenSSH Idle Timeout Interval</title>
        <affected family="unix">
        </affected>
        <description>The SSH idle timeout interval should be set to an
      appropriate value.</description>
      <reference source="ssg" ref_id="sshd_set_idle_timeout"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_idle_timeout:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_set_keepalive:def:1" version="1">
      <metadata>
        <title>Set ClientAliveCountMax for User Logins</title>
        <affected family="unix">
        </affected>
        <description>The SSH ClientAliveCountMax should be set to an appropriate
      value (and dependencies are met)</description>
      <reference source="ssg" ref_id="sshd_set_keepalive"/></metadata>
      <criteria comment="SSH is not being used or conditions are met" operator="OR">
        <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
        <criterion comment="Check ClientAliveCountMax in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_clientalivecountmax:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_use_approved_ciphers:def:1" version="1">
      <metadata>
        <title>Use Only Approved Ciphers</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Limit the ciphers to those which are FIPS-approved and only
      use ciphers in counter (CTR) mode.</description>
      <reference source="ssg" ref_id="sshd_use_approved_ciphers"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is certified" definition_ref="oval:ssg-installed_OS_is_certified:def:1"/>
        <criteria comment="SSH is not being used or conditions are met" operator="OR">
          <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
          <criterion comment="Check the Cipers list in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_use_approved_ciphers:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sshd_use_approved_macs:def:1" version="1">
      <metadata>
        <title>Use Only FIPS MACs</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.</description>
      <reference source="ssg" ref_id="sshd_use_approved_macs"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Installed OS is certified" definition_ref="oval:ssg-installed_OS_is_certified:def:1"/>
        <criteria comment="SSH is not being used or conditions are met" operator="OR">
          <extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
          <criterion comment="Check MACs in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_use_approved_macs:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysconfig_networking_bootproto_ifcfg:def:1" version="2">
      <metadata>
        <title>Disable DHCP Client</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>DHCP configuration should be static for all
      interfaces.</description>
      <reference source="ssg" ref_id="sysconfig_networking_bootproto_ifcfg"/></metadata>
      <criteria comment="Test for BOOTPROTO=(static|none) across all interfaces">
        <criterion test_ref="oval:ssg-test_sysconfig_networking_bootproto_ifcfg:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The "kernel.dmesg_restrict" kernel parameter should be set to "1" in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_kernel_dmesg_restrict"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.dmesg_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1"/>
        <extend_definition comment="kernel.dmesg_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_exec_shield:def:1" version="2">
      <metadata>
        <title>Kernel Runtime Parameter "kernel.exec-shield" Check</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel runtime parameter "kernel.exec-shield" should not be disabled and set to 1 on 32-bit systems.</description>
      <reference source="ssg" ref_id="sysctl_kernel_exec_shield"/></metadata>
      <criteria operator="OR">
        <criteria operator="AND" comment="system is RHEL6">
          <extend_definition comment="RHEL6 installed" definition_ref="oval:ssg-installed_OS_is_rhel6:def:1"/>
          <criterion comment="kernel runtime parameter kernel.exec-shield set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_exec_shield:tst:1"/>
          <criterion comment="kernel /etc/sysctl.conf parameter kernel.exec-shield set to 1" test_ref="oval:ssg-test_static_sysctl_kernel_exec_shield:tst:1"/>
        </criteria>
        <criteria operator="AND">
          <extend_definition comment="32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
          <criterion comment="kernel runtime parameter kernel.exec-shield set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_exec_shield:tst:1"/>
          <criterion comment="kernel /etc/sysctl.conf parameter kernel.exec-shield set to 1" test_ref="oval:ssg-test_static_sysctl_kernel_exec_shield:tst:1"/>
        </criteria>
        <criteria operator="AND">
          <extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
          <criterion comment="NX is supported and is not disabled" test_ref="oval:ssg-test_nx_disabled_grub:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2">
      <metadata>
        <title>Kernel Runtime Parameter IPv6 Check</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>Disables IPv6 for all network interfaces.</description>
      <reference source="ssg" ref_id="sysctl_kernel_ipv6_disable"/></metadata>
      <criteria comment="IPv6 disabled or net.ipv6.conf.all.disable_ipv6 set correctly" operator="OR">
        <criteria operator="AND">
          <extend_definition comment="net.ipv6.conf.all.disable_ipv6 configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1"/>
          <extend_definition comment="net.ipv6.conf.all.disable_ipv6 runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Configuration and Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The "kernel.randomize_va_space" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
      <reference source="ssg" ref_id="sysctl_kernel_randomize_va_space"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="kernel.randomize_va_space configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1"/>
        <extend_definition comment="kernel.randomize_va_space runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_kernel_dmesg_restrict"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="oval:ssg-test_runtime_kernel_dmesg_restrict:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "kernel.randomize_va_space" parameter should be set to "2" in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_kernel_randomize_va_space"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="oval:ssg-test_runtime_sysctl_kernel_randomize_va_space:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.disable_ipv6" Parameter Runtime Check</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.disable_ipv6" parameter should be set to "1" in system runtime.</description>
      <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_disable_ipv6"/></metadata>
      <criteria operator="AND">
        <criterion comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" test_ref="oval:ssg-test_runtime_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.dmesg_restrict" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_kernel_dmesg_restrict"/></metadata>
      <criteria operator="OR">
        <!-- RHEL-6 sysctl behavior observations:
           * sysctl honours last occurrence of particular directive,
           * apply_sysctl() routine called by /etc/rc.d/rc.sysinit script from initscripts RPM package
             applies sysctl settings in the following order:
             * first sysctl settings from /etc/sysctl.conf are applied,
             * then /etc/sysctl.d/* files are first sorted in lexicographic order, and
             * subsequently sysctl settings from them are applied to form the final configuration

           See https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646
           for further details.

           Since so far there isn't a way how to perform a lexicographic sort in OVAL, this OVAL check
           will behave as follows:
           * perform the verification in reversed order (check /etc/sysctl.d/* first, then /etc/sysctl.conf)
           * if there's just one /etc/sysctl.d/* file containing the kernel.dmesg_restrict directive, return PASS
             if the requirements are met, FAIL otherwise,
           * if there are two or more /etc/sysctl.d/* files containing the kernel.dmesg_restrict directive, return FAIL
             (since in this case we aren't able with absolute certainty to tell which /etc/sysctl.d/* file
             would be applied as the last one)
           * if there's no /etc/sysctl.d/* file containing the kernel.dmesg_restrict directive, and /etc/sysctl.conf
             contains the kernel.dmesg_restrict directive, return PASS if the requirements are met, FAIL otherwise. -->
        <criterion comment="Kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.d/*" test_ref="oval:ssg-test_static_sysctld_kernel_dmesg_restrict:tst:1"/>
        <criteria operator="AND">
          <criterion comment="Kernel static paramater kernel.dmesg_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_etc_sysctl_kernel_dmesg_restrict:tst:1"/>
          <criterion comment="Kernel static parameter kernel.dmesg_restrict not present in some /etc/sysctl.d/* file" test_ref="oval:ssg-test_static_sysctld_kernel_dmesg_restrict_not_used:tst:1"/>
        </criteria>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" version="3">
      <metadata>
        <title>Kernel "kernel.randomize_va_space" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "kernel.randomize_va_space" parameter should be set to "2" in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_kernel_randomize_va_space"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1"/>
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1"/>
        <criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" version="3">
      <metadata>
        <title>Kernel "net.ipv6.conf.all.disable_ipv6" Parameter Configuration Check</title>
        <affected family="unix">
          <platform>Fedora 23</platform>
          <platform>Fedora 24</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
        </affected>
        <description>The kernel "net.ipv6.conf.all.disable_ipv6" parameter should be set to "1" in the system configuration.</description>
      <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_disable_ipv6"/></metadata>
      <criteria operator="OR">
        <criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1"/>
        <!-- see sysctl.d(5) -->
        <criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1"/>
        <criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_64bit:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for 64-bit Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for 64-bit architectures to be used by other tests</description>
      <reference source="ssg" ref_id="system_info_architecture_64bit"/></metadata>
      <criteria operator="OR">
        <extend_definition comment="Generic test for x86_64 architecture" definition_ref="oval:ssg-system_info_architecture_x86_64:def:1"/>
        <extend_definition comment="Generic test for ppc64 architecture" definition_ref="oval:ssg-system_info_architecture_ppc_64:def:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_ppc_64:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for PPC and PPCLE Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for PPC PPC64LE architecture to be used by other tests</description>
      <reference source="ssg" ref_id="system_info_architecture_ppc_64"/></metadata>
      <criteria operator="OR">
        <criterion comment="Generic test for ppc64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppc_64:tst:1"/>
        <criterion comment="Generic test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_x86:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for x86 Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for x86 architecture to be used by other tests</description>
      <reference source="ssg" ref_id="system_info_architecture_x86"/></metadata>
      <criteria>
        <criterion comment="Generic test for x86 architecture" test_ref="oval:ssg-test_system_info_architecture_x86:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-system_info_architecture_x86_64:def:1" version="1">
      <!-- Note that this does not meet requirements for class=inventory as
         that only tests for patches per 5.10.1 Revision 1 -->
      <metadata>
        <title>Test for x86_64 Architecture</title>
        <affected family="unix">
        </affected>
        <description>Generic test for x86_64 architecture to be used by other tests</description>
      <reference source="ssg" ref_id="system_info_architecture_x86_64"/></metadata>
      <criteria>
        <criterion comment="Generic test for x86_64 architecture" test_ref="oval:ssg-test_system_info_architecture_x86_64:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-tftpd_uses_secure_mode:def:1" version="1">
      <metadata>
        <title>TFTP Daemon Uses Secure Mode</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The TFTP daemon should use secure mode.</description>
      <reference source="ssg" ref_id="tftpd_uses_secure_mode"/></metadata>
      <criteria comment="package tftp-server removed or /etc/xinetd.d/tftp configured correctly" operator="OR">
        <extend_definition comment="rpm package tftp-server removed" definition_ref="oval:ssg-package_tftp-server_removed:def:1"/>
        <criterion comment="tftpd secure mode" test_ref="oval:ssg-test_tftpd_uses_secure_mode:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-umask_for_daemons:def:1" version="2">
      <metadata>
        <title>Set Daemon umask</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The daemon umask should be set as appropriate</description>
      <reference source="ssg" ref_id="umask_for_daemons"/></metadata>
      <criteria operator="AND">
        <extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_umask_for_daemons_as_number:def:1"/>
        <criterion test_ref="oval:ssg-tst_umask_for_daemons:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-userowner_shadow_file:def:1" version="1">
      <metadata>
        <title>Verify user who owns 'shadow' file</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>The /etc/shadow file should be owned by the
      appropriate user.</description>
      <reference source="ssg" ref_id="userowner_shadow_file"/></metadata>
      <criteria>
        <criterion comment="Check file ownership of /etc/shadow" test_ref="oval:ssg-test_userowner_shadow_file:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-var_accounts_user_umask_as_number:def:1" version="1">
      <metadata>
        <title>Value of 'var_accounts_user_umask' variable represented as octal number</title>
        <affected family="unix">
          <platform>Wind River Linux 8</platform>
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Value of 'var_accounts_user_umask' variable represented as octal number</description>
      <reference source="ssg" ref_id="var_accounts_user_umask_as_number"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1">
      <metadata>
        <title>Value of 'var_removable_partition' variable is set to '/dev/cdrom'</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Verify if value of 'var_removable_partition' variable is set
      to '/dev/cdrom'</description>
      <reference source="ssg" ref_id="var_removable_partition_is_cd_dvd_drive"/></metadata>
      <criteria>
        <criterion test_ref="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" comment="Check if removable partition value represents CD/DVD drive"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-var_umask_for_daemons_as_number:def:1" version="1">
      <metadata>
        <title>Value of 'var_umask_for_daemons' variable represented as octal number</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>Value of 'var_umask_for_daemons' variable represented as octal number</description>
      <reference source="ssg" ref_id="var_umask_for_daemons_as_number"/></metadata>
      <criteria operator="AND">
        <criterion test_ref="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1"/>
      </criteria>
    </definition>
    <definition class="compliance" id="oval:ssg-wireless_disable_interfaces:def:1" version="1">
      <metadata>
        <title>Deactivate Wireless Interfaces</title>
        <affected family="unix">
          <platform>Red Hat Enterprise Linux 7</platform>
          <platform>Red Hat Enterprise Linux 6</platform>
        </affected>
        <description>All wireless interfaces should be disabled.</description>
      <reference source="ssg" ref_id="wireless_disable_interfaces"/></metadata>
      <criteria>
        <criterion comment="query /proc/net/wireless" test_ref="oval:ssg-test_wireless_disable_interfaces:tst:1"/>
      </criteria>
    </definition>
  </definitions>
  <tests>
    <ind:textfilecontent54_test check="at least one" check_existence="all_exist" comment="Ensure the /etc/sysconfig/docker contains '--selinux-enabled' in the OPTIONS field" id="oval:ssg-test_docker_selinux_enabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_docker_selinux_enabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="Check if the docker storage configuration files contain STORAGE_DRIVER=devicemapper" id="oval:ssg-test_docker_devicemapper:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_docker_storage_driver:obj:1"/>
      <ind:state state_ref="oval:ssg-state_docker_storage_driver:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="at least one" check_existence="all_exist" comment="Ensure the docker storage configuration files contain --storage-opt dm.thinpooldev set" id="oval:ssg-test_docker_thinpool_device:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_storage_device_path:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="at least one" comment="Ensure the file specified as thinpool device exists" id="oval:ssg-test_device_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-obj_storage_device:obj:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt_removed:tst:1" version="1" comment="package abrt is removed">
      <linux:object object_ref="oval:ssg-obj_package_abrt_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_acpid_removed:tst:1" version="1" comment="package acpid is removed">
      <linux:object object_ref="oval:ssg-obj_package_acpid_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_at_removed:tst:1" version="1" comment="package at is removed">
      <linux:object object_ref="oval:ssg-obj_package_at_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_autofs_removed:tst:1" version="1" comment="package autofs is removed">
      <linux:object object_ref="oval:ssg-obj_package_autofs_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_avahi_removed:tst:1" version="1" comment="package avahi is removed">
      <linux:object object_ref="oval:ssg-obj_package_avahi_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_bind_removed:tst:1" version="1" comment="package bind is removed">
      <linux:object object_ref="oval:ssg-obj_package_bind_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_bluez_removed:tst:1" version="1" comment="package bluez is removed">
      <linux:object object_ref="oval:ssg-obj_package_bluez_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_certmonger_removed:tst:1" version="1" comment="package certmonger is removed">
      <linux:object object_ref="oval:ssg-obj_package_certmonger_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_cups_removed:tst:1" version="1" comment="package cups is removed">
      <linux:object object_ref="oval:ssg-obj_package_cups_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_cyrus-sasl_removed:tst:1" version="1" comment="package cyrus-sasl is removed">
      <linux:object object_ref="oval:ssg-obj_package_cyrus-sasl_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_dbus_removed:tst:1" version="1" comment="package dbus is removed">
      <linux:object object_ref="oval:ssg-obj_package_dbus_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_dhcp_removed:tst:1" version="1" comment="package dhcp is removed">
      <linux:object object_ref="oval:ssg-obj_package_dhcp_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_docker_installed:tst:1" version="1" comment="package docker is installed">
      <linux:object object_ref="oval:ssg-obj_package_docker_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_dovecot_removed:tst:1" version="1" comment="package dovecot is removed">
      <linux:object object_ref="oval:ssg-obj_package_dovecot_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_esc_installed:tst:1" version="1" comment="package esc is installed">
      <linux:object object_ref="oval:ssg-obj_package_esc_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_httpd_removed:tst:1" version="1" comment="package httpd is removed">
      <linux:object object_ref="oval:ssg-obj_package_httpd_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_iputils_removed:tst:1" version="1" comment="package iputils is removed">
      <linux:object object_ref="oval:ssg-obj_package_iputils_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_irqbalance_installed:tst:1" version="1" comment="package irqbalance is installed">
      <linux:object object_ref="oval:ssg-obj_package_irqbalance_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_kernel-tools_removed:tst:1" version="1" comment="package kernel-tools is removed">
      <linux:object object_ref="oval:ssg-obj_package_kernel-tools_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_kexec-tools_removed:tst:1" version="1" comment="package kexec-tools is removed">
      <linux:object object_ref="oval:ssg-obj_package_kexec-tools_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_libcgroup-tools_removed:tst:1" version="1" comment="package libcgroup-tools is removed">
      <linux:object object_ref="oval:ssg-obj_package_libcgroup-tools_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_libcgroup_removed:tst:1" version="1" comment="package libcgroup is removed">
      <linux:object object_ref="oval:ssg-obj_package_libcgroup_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_mdadm_removed:tst:1" version="1" comment="package mdadm is removed">
      <linux:object object_ref="oval:ssg-obj_package_mdadm_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" comment="package net-snmp is removed">
      <linux:object object_ref="oval:ssg-obj_package_net-snmp_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
      <linux:object object_ref="oval:ssg-obj_package_nfs-utils_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_ntp_installed:tst:1" version="1" comment="package ntp is installed">
      <linux:object object_ref="oval:ssg-obj_package_ntp_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" comment="package ntpdate is removed">
      <linux:object object_ref="oval:ssg-obj_package_ntpdate_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_oddjob_removed:tst:1" version="1" comment="package oddjob is removed">
      <linux:object object_ref="oval:ssg-obj_package_oddjob_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_openssh-server_installed:tst:1" version="1" comment="package openssh-server is installed">
      <linux:object object_ref="oval:ssg-obj_package_openssh-server_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" comment="package openssh-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_openssh-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_pam_pkcs11_installed:tst:1" version="1" comment="package pam_pkcs11 is installed">
      <linux:object object_ref="oval:ssg-obj_package_pam_pkcs11_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_pcsc-lite_installed:tst:1" version="1" comment="package pcsc-lite is installed">
      <linux:object object_ref="oval:ssg-obj_package_pcsc-lite_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_portreserve_removed:tst:1" version="1" comment="package portreserve is removed">
      <linux:object object_ref="oval:ssg-obj_package_portreserve_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_postfix_installed:tst:1" version="1" comment="package postfix is installed">
      <linux:object object_ref="oval:ssg-obj_package_postfix_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_psacct_installed:tst:1" version="1" comment="package psacct is installed">
      <linux:object object_ref="oval:ssg-obj_package_psacct_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_qpid-cpp-server_removed:tst:1" version="1" comment="package qpid-cpp-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_qpid-cpp-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_quagga_removed:tst:1" version="1" comment="package quagga is removed">
      <linux:object object_ref="oval:ssg-obj_package_quagga_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_quota-nld_removed:tst:1" version="1" comment="package quota-nld is removed">
      <linux:object object_ref="oval:ssg-obj_package_quota-nld_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_rhnsd_removed:tst:1" version="1" comment="package rhnsd is removed">
      <linux:object object_ref="oval:ssg-obj_package_rhnsd_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_samba_removed:tst:1" version="1" comment="package samba is removed">
      <linux:object object_ref="oval:ssg-obj_package_samba_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_smartmontools_removed:tst:1" version="1" comment="package smartmontools is removed">
      <linux:object object_ref="oval:ssg-obj_package_smartmontools_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_squid_removed:tst:1" version="1" comment="package squid is removed">
      <linux:object object_ref="oval:ssg-obj_package_squid_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_sssd_installed:tst:1" version="1" comment="package sssd is installed">
      <linux:object object_ref="oval:ssg-obj_package_sssd_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_sssd_removed:tst:1" version="1" comment="package sssd is removed">
      <linux:object object_ref="oval:ssg-obj_package_sssd_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_subscription-manager_removed:tst:1" version="1" comment="package subscription-manager is removed">
      <linux:object object_ref="oval:ssg-obj_package_subscription-manager_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_sysstat_removed:tst:1" version="1" comment="package sysstat is removed">
      <linux:object object_ref="oval:ssg-obj_package_sysstat_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_tcp_wrappers_installed:tst:1" version="1" comment="package tcp_wrappers is installed">
      <linux:object object_ref="oval:ssg-obj_package_tcp_wrappers_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_tftp-server_removed:tst:1" version="1" comment="package tftp-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_tftp-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_vsftpd_removed:tst:1" version="1" comment="package vsftpd is removed">
      <linux:object object_ref="oval:ssg-obj_package_vsftpd_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_xinetd_installed:tst:1" version="1" comment="package xinetd is installed">
      <linux:object object_ref="oval:ssg-obj_package_xinetd_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_xinetd_removed:tst:1" version="1" comment="package xinetd is removed">
      <linux:object object_ref="oval:ssg-obj_package_xinetd_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_ypbind_removed:tst:1" version="1" comment="package ypbind is removed">
      <linux:object object_ref="oval:ssg-obj_package_ypbind_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_pcscd.socket:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_pcscd.socket:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_pcscd.socket_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_abrtd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_abrtd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_abrtd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_acpid_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_acpid:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_acpid_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_atd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_atd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_atd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_auditd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_auditd_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_autofs_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_autofs:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_autofs_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_avahi-daemon_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_avahi-daemon:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_avahi-daemon_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_bluetooth_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_bluetooth:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_bluetooth_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_certmonger_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_certmonger:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_certmonger_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_cgconfig_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_cgconfig:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_cgconfig_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_cgred_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_cgred:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_cgred_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_chronyd:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_chronyd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_chronyd_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_cpupower_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_cpupower:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_cpupower_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_crond:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_crond:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_crond_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_cups_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_cups:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_cups_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_debug-shell_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_debug-shell:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_debug-shell_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_dhcpd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_dhcpd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_dhcpd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_docker:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_docker:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_docker_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_dovecot_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_dovecot:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_dovecot_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_firewalld:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_firewalld:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_firewalld_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_httpd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_httpd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_httpd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_irqbalance:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_irqbalance:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_irqbalance_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_kdump_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_kdump:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_kdump_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_mdmonitor_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_mdmonitor:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_mdmonitor_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_messagebus_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_messagebus:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_messagebus_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_named_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_named:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_named_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_netconsole_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_netconsole:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_netconsole_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_nfs_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_nfs:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_nfs_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_nfslock_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_nfslock:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_nfslock_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ntpd:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntpd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_ntpd_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_ntpdate_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntpdate:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_ntpdate_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_oddjobd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_oddjobd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_oddjobd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_portreserve_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_portreserve:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_portreserve_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_postfix:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_postfix:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_postfix_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_psacct:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_psacct:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_psacct_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_qpidd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_qpidd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_qpidd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_quota_nld_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_quota_nld:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_quota_nld_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_rdisc_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rdisc:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rdisc_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <ind:textfilecontent54_test check="all" comment="rexec disabled" id="oval:ssg-test_etc_xinetd_rexec_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_xinetd_rexec_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_rexec_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rexec:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rexec_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_rhnsd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rhnsd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rhnsd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_rhsmcertd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rhsmcertd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rhsmcertd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <ind:textfilecontent54_test check="all" comment="rlogin disabled" id="oval:ssg-test_etc_xinetd_rlogin_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_xinetd_rlogin_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_rlogin_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rlogin:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rlogin_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_rpcbind_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rpcbind:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rpcbind_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_rpcgssd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rpcgssd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rpcgssd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_rpcidmapd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rpcidmapd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rpcidmapd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_rpcsvcgssd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rpcsvcgssd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rpcsvcgssd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <ind:textfilecontent54_test check="all" comment="rsh disabled" id="oval:ssg-test_etc_xinetd_rsh_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_xinetd_rsh_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_rsh_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rsh:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rsh_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_rsyslog_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_saslauthd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_saslauthd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_saslauthd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_smartd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_smartd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_smartd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_smb_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_smb:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_smb_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_snmpd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_snmpd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_snmpd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_squid_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_squid:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_squid_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_sshd:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_sshd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_sshd_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_sssd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_sssd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_sssd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_sssd:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_sssd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_sssd_on:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_sysstat_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_sysstat:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_sysstat_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Disable Telnet Service" id="oval:ssg-test_xinetd_telnetd_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_xinetd_telnetd_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_telnet_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_telnet:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_telnet_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_tftp_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_tftp:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_tftp_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_vsftpd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_vsftpd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_vsftpd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_xinetd_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_xinetd:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_xinetd_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_ypbind_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_ypbind:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_ypbind_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_zebra_not_wanted_by_multi_user_target:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_multi_user_target_for_zebra:obj:1"/>
      <linux:state state_ref="oval:ssg-state_systemd_zebra_off:ste:1"/>
    </linux:systemdunitdependency_test>
    <ind:textfilecontent54_test id="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test ocsp_on in /etc/pam_pkcs11/pkcs11.conf" version="1">
      <ind:object object_ref="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1"/>
      <ind:state state_ref="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_smart_card_enabled_system_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is enabled in /etc/pam.d/system-auth file" version="1">
      <ind:object object_ref="oval:ssg-object_smart_card_enabled_system_auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_smart_card_required_system_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is required in /etc/pam.d/system-auth file" version="1">
      <ind:object object_ref="oval:ssg-object_smart_card_required_system_auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is required in /etc/pam.d/smartcard-auth file" version="1">
      <ind:object object_ref="oval:ssg-object_smart_card_required_smartcard_auth:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing if /etc/sssd/sssd.conf exists" id="oval:ssg-test_sssd_conf_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sssd_conf_exists:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of memcache_timeoutsetting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_memcache_timeout:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sssd_memcache_timeout:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of offline_credentials_expiration setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_offline_cred_expiration:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sssd_offline_cred_expiration:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of ssh_known_hosts_timeout setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sssd_ssh_known_hosts_timeout:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure more than one chronyd NTP server is set" id="oval:ssg-test_chronyd_multiple_servers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_chronyd_multiple_servers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure at least one NTP server is set" id="oval:ssg-test_chronyd_remote_server:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_chronyd_remote_server:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:symlink_test check="all" check_existence="all_exist" comment="Disable Ctrl-Alt-Del key sequence override exists" id="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_disable_ctrlaltdel_exists:obj:1"/>
      <unix:state state_ref="oval:ssg-state_disable_ctrlaltdel_exists:ste:1"/>
    </unix:symlink_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the disable_plaintext_auth[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/dovecot.conf file" id="oval:ssg-test_dovecot_disable_plaintext_auth:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dovecot_disable_plaintext_auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ssl[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/dovecot.conf file" id="oval:ssg-test_dovecot_enable_ssl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dovecot_enable_ssl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure more than one ntpd NTP server is set" id="oval:ssg-test_ntpd_multiple_servers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ntpd_multiple_servers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure at least one ntpd NTP server is set" id="oval:ssg-test_ntp_remote_server:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ntp_remote_server:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_audit_installed:tst:1" version="1" comment="package audit is installed">
      <linux:object object_ref="oval:ssg-obj_package_audit_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_chrony_installed:tst:1" version="1" comment="package chrony is installed">
      <linux:object object_ref="oval:ssg-obj_package_chrony_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_cronie_installed:tst:1" version="1" comment="package cronie is installed">
      <linux:object object_ref="oval:ssg-obj_package_cronie_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_firewalld_installed:tst:1" version="1" comment="package firewalld is installed">
      <linux:object object_ref="oval:ssg-obj_package_firewalld_installed:obj:1"/>
    </linux:rpminfo_test>
    <ind:textfilecontent54_test id="oval:ssg-test_postfix_network_listening_disabled:tst:1" check="all" check_existence="at_least_one_exists" comment="inet_interfaces in /etc/postfix/main.cf should be set correctly" version="1">
      <ind:object object_ref="oval:ssg-obj_postfix_network_listening_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" comment="System log files are owned by root group">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_groupownership:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_groupownership:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" comment="System log files are owned by root">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_ownership:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_ownership:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" comment="Permissions of system log files are 0600">
      <unix:object object_ref="oval:ssg-object_rsyslog_files_permissions:obj:1"/>
      <unix:state state_ref="oval:ssg-state_rsyslog_files_permissions:ste:1"/>
    </unix:file_test>
    <unix:symlink_test check="all" check_existence="all_exist" comment="default.target systemd softlink exists" id="oval:ssg-test_disable_xwindows_runlevel:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_disable_xwindows_runlevel:obj:1"/>
      <unix:state state_ref="oval:ssg-state_disable_xwindows_runlevel:ste:1"/>
    </unix:symlink_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check FAIL_DELAY in /etc/login.defs" id="oval:ssg-test_accounts_logon_fail_delay:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_logon_fail_delay:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_logon_fail_delay:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_preauth_silent_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_pam_faillock_preauth_silent_system-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_authfail_deny_root_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/system-auth (authfail)" version="1">
      <ind:object object_ref="oval:ssg-object_pam_faillock_authfail_deny_root_system-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_preauth_silent_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth" version="1">
      <ind:object object_ref="oval:ssg-object_pam_faillock_preauth_silent_password-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_authfail_deny_root_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/password-auth (authfail)" version="1">
      <ind:object object_ref="oval:ssg-object_pam_faillock_authfail_deny_root_password-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of clean_requirements_on_remove in /etc/yum.conf" id="oval:ssg-test_yum_clean_components_post_updating:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_yum_clean_components_post_updating:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of localpkg_gpgcheck in /etc/yum.conf" id="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of repo_gpgcheck in /etc/yum.conf" id="oval:ssg-test_yum_ensure_gpgcheck_repo_metadata:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_repo_metadata:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership /etc/cron.allow" id="oval:ssg-test_groupowner_etc_cron_allow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_groupowner_cron_allow_file:obj:1"/>
      <unix:state state_ref="oval:ssg-state_groupowner_cron_allow_file:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /etc/cron.allow" id="oval:ssg-test_userowner_cron_allow_file:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_etc_cron_allow:obj:1"/>
      <unix:state state_ref="oval:ssg-state_etc_cron_allow_uid_root:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing file permissions" id="oval:ssg-test_file_permissions_sshd_private_key:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_sshd_private_key:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_permissions_sshd_private_key:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing file permissions" id="oval:ssg-test_file_permissions_sshd_pub_key:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_sshd_pub_key:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_permissions_sshd_pub_key:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="setgid files outside system RPMs" id="oval:ssg-check_setgid_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_unauthorized_sgid:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="setuid files outside system RPMs" id="oval:ssg-check_setuid_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_unauthorized_suid:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test id="oval:ssg-test_grub2_enable_fips_mode:tst:1" comment="check for fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_grub2_enable_fips_mode:obj:1"/>
      <ind:state state_ref="oval:ssg-state_grub2_enable_fips_mode:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_grub2_enable_fips_mode_default:tst:1" comment="check for fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_grub2_enable_fips_mode_default:obj:1"/>
      <ind:state state_ref="oval:ssg-state_grub2_enable_fips_mode:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_grub2_default_exists:tst:1" comment="check for GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_grub2_default_exists:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_kernel-PAE_installed:tst:1" version="1" comment="Package kernel-PAE is installed">
      <linux:object object_ref="oval:ssg-obj_package_kernel-PAE_installed:obj:1"/>
    </linux:rpminfo_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" version="1" check="all" comment="kernel module bluetooth disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /etc/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_etcmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /run/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_runmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_libmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_disabled:tst:1" version="1" check="all" comment="kernel module cramfs disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /etc/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_etcmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /run/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_runmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /usr/lib/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_libmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" version="1" check="all" comment="kernel module freevxfs disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /etc/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_etcmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /run/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_runmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_libmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_disabled:tst:1" version="1" check="all" comment="kernel module hfs disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfs_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfs disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /etc/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfs_etcmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /run/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfs_runmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /usr/lib/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfs_libmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" version="1" check="all" comment="kernel module hfsplus disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /etc/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_etcmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /run/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_runmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_libmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_disabled:tst:1" version="1" check="all" comment="kernel module jffs2 disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /etc/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_etcmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /run/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_runmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_libmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_sctp_disabled:tst:1" version="1" check="all" comment="kernel module sctp disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_sctp_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_sctp_modprobeconf:tst:1" version="1" check="all" comment="kernel module sctp disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_sctp_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_sctp_etcmodules-load:tst:1" version="1" check="all" comment="kernel module sctp disabled in /etc/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_sctp_etcmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_sctp_runmodules-load:tst:1" version="1" check="all" comment="kernel module sctp disabled in /run/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_sctp_runmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_sctp_libmodules-load:tst:1" version="1" check="all" comment="kernel module sctp disabled in /usr/lib/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_sctp_libmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_disabled:tst:1" version="1" check="all" comment="kernel module squashfs disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /etc/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_etcmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /run/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_runmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /usr/lib/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_libmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_disabled:tst:1" version="1" check="all" comment="kernel module udf disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_udf_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" version="1" check="all" comment="kernel module udf disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /etc/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_udf_etcmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /run/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_udf_runmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /usr/lib/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_udf_libmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="all nfs has krb_sec" id="oval:ssg-test_nfs_krb_sec_etc_fstab:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_nfs_krb_sec_etc_fstab:obj:1"/>
      <ind:state state_ref="oval:ssg-state_remote_filesystem_krb_sec:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="no nfs" id="oval:ssg-test_no_nfs_defined_etc_fstab_krb_sec:tst:1" version="1">
      <!-- this test returns 'true' if /etc/fstab does not contain nfs/nfs4 mounts -->
      <ind:object object_ref="oval:ssg-object_no_nfs_defined_etc_fstab_krb_sec:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests for the existence of DHCP_HOSTNAME in the /etc/sysconfig/network-scripts/ifcfg-.* file" id="oval:ssg-test_network_disable_ddns_interfaces_ifcfg:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_disable_ddns_interfaces_ifcfg:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests for the existence of 'send host-name' in /etc/dhclient.conf file" id="oval:ssg-test_network_disable_ddns_interfaces_dhclient:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_disable_ddns_interfaces_dhclient:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests for the existence of 'send host-name' in the /etc/dhcp folder" id="oval:ssg-test_network_disable_ddns_interfaces_dhcp:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_disable_ddns_interfaces_dhcp:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_aide_installed:tst:1" version="1" comment="package aide is installed">
      <linux:object object_ref="oval:ssg-obj_package_aide_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_dconf_installed:tst:1" version="1" comment="package dconf is installed">
      <linux:object object_ref="oval:ssg-obj_package_dconf_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_vsftpd_installed:tst:1" version="1" comment="package vsftpd is installed">
      <linux:object object_ref="oval:ssg-obj_package_vsftpd_installed:obj:1"/>
    </linux:rpminfo_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="cron is configured in /etc/rsyslog.conf" id="oval:ssg-test_cron_logging_rsyslog:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="cron is configured in /etc/rsyslog.d" id="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel0_nails:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel0_nails:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nails_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel1_nails:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel1_nails:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nails_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel2_nails:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel2_nails:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nails_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel3_nails:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel3_nails:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nails_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel4_nails:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel4_nails:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nails_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel5_nails:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel5_nails:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nails_on:ste:1"/>
    </unix:runlevel_test>
    <unix:runlevel_test check="all" check_existence="any_exist" comment="Runlevel test" id="oval:ssg-test_runlevel6_nails:tst:1" version="2">
      <unix:object object_ref="oval:ssg-obj_runlevel6_nails:obj:1"/>
      <unix:state state_ref="oval:ssg-state_service_nails_on:ste:1"/>
    </unix:runlevel_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Compression setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_compression:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_disable_compression:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of KerberosAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_kerb_auth:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_strictmodes:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_enable_strictmodes:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PrintLastLog setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_printlastlog:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_enable_printlastlog:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of UsePrivilegeSeparation setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_use_priv_separation:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_use_priv_separation:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="!authenticate does not exist in /etc/sudoers" id="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="!authenticate does not exist in /etc/sudoers.d" id="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD does not exist /etc/sudoers" id="oval:ssg-test_nopasswd_etc_sudoers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_nopasswd_etc_sudoers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD does not exist in /etc/sudoers.d" id="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.suid_dumpable set to 0" id="oval:ssg-test_runtime_sysctl_fs_suid_dumpable:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_fs_suid_dumpable:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_fs_suid_dumpable:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_accept_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_accept_source_route:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_source_route:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_log_martians:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_log_martians:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_log_martians:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_rp_filter:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_rp_filter:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_rp_filter:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_secure_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_secure_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_all_send_redirects:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_all_send_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_all_send_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_accept_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_accept_source_route:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_source_route:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_log_martians:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_log_martians:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_log_martians:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_rp_filter:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_rp_filter:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_rp_filter:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_secure_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_secure_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" id="oval:ssg-test_runtime_sysctl_net_ipv4_conf_default_send_redirects:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_conf_default_send_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_conf_default_send_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.ip_forward set to 0" id="oval:ssg-test_runtime_sysctl_net_ipv4_ip_forward:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_ip_forward:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_ip_forward:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv4_tcp_syncookies:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv4_tcp_syncookies:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv4_tcp_syncookies:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv6_conf_all_accept_ra:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.accept_redirects set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv6_conf_all_accept_redirects:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.accept_source_route set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv6_conf_all_accept_source_route:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_source_route:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_source_route:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.forwarding set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv6_conf_all_forwarding:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_forwarding:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_forwarding:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv6_conf_default_accept_ra:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_redirects:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_redirects:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_source_route set to the appropriate value" id="oval:ssg-test_runtime_sysctl_net_ipv6_conf_default_accept_source_route:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_source_route:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_source_route:ste:1"/>
    </unix:sysctl_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.suid_dumpable static configuration" id="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_source_route static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.log_martians static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.rp_filter static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.secure_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.send_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_source_route static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.log_martians static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.rp_filter static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.secure_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.send_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.ip_forward static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.tcp_syncookies static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.accept_ra static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.accept_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.accept_source_route static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.forwarding static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_forwarding:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_forwarding:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_forwarding:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.forwarding static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_forwarding:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_forwarding:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_forwarding:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.forwarding static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_forwarding:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_forwarding:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_forwarding:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.forwarding static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_forwarding:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_forwarding:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_forwarding:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_ra static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_source_route static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_source_route:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_source_route:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_source_route:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the Kerberos Settings in /etc/exports" id="oval:ssg-test_use_kerberos_security_all_exports:tst:1" version="2">
      <ind:object object_ref="oval:ssg-obj_use_kerberos_security_all_exports:obj:1"/>
      <ind:state state_ref="oval:ssg-state_use_kerberos_security_all_exports:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests if a share is configured in /etc/exports" id="oval:ssg-test_non_empty_exports_file:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_non_empty_exports_file:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd" id="oval:ssg-test_etc_default_useradd_inactive:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_default_useradd_inactive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_default_useradd_inactive:ste:1"/>
      <ind:state state_ref="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" check="all" check_existence="all_exist" comment="There should not exist duplicate user name entries in /etc/passwd" version="1">
      <ind:object object_ref="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" id="oval:ssg-test_maxlogins:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1"/>
      <ind:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" id="oval:ssg-test_limitsd_maxlogins:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1"/>
      <ind:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" id="oval:ssg-test_limitsd_maxlogins_exists:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_pass_max_days:tst:1" check="all" comment="The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_max_days_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_max_days_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_pass_min_days:tst:1" check="all" comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_min_days_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_min_days_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file" id="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_no_uid_except_root:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:password_test check="all" comment="password hashes are shadowed" id="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_accounts_password_all_shadowed:obj:1"/>
      <unix:state state_ref="oval:ssg-state_accounts_password_all_shadowed:ste:1"/>
    </unix:password_test>
    <ind:variable_test id="oval:ssg-test_pass_min_len:tst:1" check="all" comment="The value of PASS_MIN_LEN should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_min_len_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_min_len_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_pwquality_dcredit:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_difok:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_difok:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_pwquality_difok:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_pwquality_lcredit:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_pwquality_maxclassrepeat:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_pwquality_maxrepeat:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_minclass:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_minclass:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_pwquality_minclass:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_minlen:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_minlen:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_pwquality_minlen:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_pwquality_ocredit:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_pwquality:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_pwquality:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_cracklib_retry:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_cracklib_retry:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_retry:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_pwquality_retry:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_retry:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_retry:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1"/>
      <ind:state state_ref="oval:ssg-state_password_pam_pwquality_ucredit:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" check="all" check_existence="all_exist" comment="Test if remember attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" check="all" check_existence="all_exist" comment="Test if remember attribute of pam_pwhistory.so is set correctly in /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_pass_warn_age:tst:1" check="all" comment="The value of PASS_WARN_AGE should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_pass_warn_age_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_pass_warn_age_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/system-auth (authfail)" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check if pam_faillock_so is called in account phase of /etc/pam.d/system-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/password-auth (authfail)" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check if pam_faillock_so is called in account phase of /etc/pam.d/password-auth" version="1">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum preauth fail_interval allowed in /etc/pam.d/system-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum authfail fail_interval allowed in /etc/pam.d/system-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum authfail fail_interval allowed in /etc/pam.d/password-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum preauth fail_interval allowed in /etc/pam.d/password-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check preauth maximum failed login attempts allowed in /etc/pam.d/system-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_system-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check authfail maximum failed login attempts allowed in /etc/pam.d/system-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_system-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check authfail maximum failed login attempts allowed in /etc/pam.d/password-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_password-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check preauth maximum failed login attempts allowed in /etc/pam.d/password-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:obj:1"/>
      <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_password-auth:ste:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="none_exist" comment="Check if there aren't directories in root's path having write permission set for group or other" id="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="TMOUT in /etc/profile" id="oval:ssg-test_etc_profile_tmout:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_profile_tmout:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="TMOUT in /etc/profile.d/*.sh" id="oval:ssg-test_etc_profiled_tmout:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_profiled_tmout:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_bashrc:tst:1" version="1" check="all" comment="Test the retrieved /etc/bashrc umask value(s) match the var_accounts_user_umask requirement">
      <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_bashrc:obj:1"/>
      <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_bashrc:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_csh_cshrc:tst:1" version="1" check="all" comment="Test the retrieved /etc/csh.cshrc umask value(s) match the var_accounts_user_umask requirement">
      <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_csh_cshrc:obj:1"/>
      <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_csh_cshrc:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1" version="1" check="all" comment="Test the retrieved /etc/login.defs umask value(s) match the var_accounts_user_umask requirement">
      <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1"/>
      <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_profile:tst:1" version="1" check="all" comment="Test the retrieved /etc/profile umask value(s) match the var_accounts_user_umask requirement">
      <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_profile:obj:1"/>
      <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_profile:ste:1"/>
    </ind:variable_test>
    <unix:file_test id="oval:ssg-test_aide_build_new_database_absolute_path:tst:1" check="all" check_existence="all_exist" comment="Testing existence of new aide database file" version="1">
      <unix:object object_ref="oval:ssg-object_aide_build_new_database_absolute_path:obj:1"/>
    </unix:file_test>
    <unix:file_test id="oval:ssg-test_aide_operational_database_absolute_path:tst:1" check="all" check_existence="all_exist" comment="Testing existence of operational aide database file" version="1">
      <unix:object object_ref="oval:ssg-object_aide_operational_database_absolute_path:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="oval:ssg-test_aide_periodic_cron_checking:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_aide_periodic_cron_checking:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="oval:ssg-test_aide_crond_checking:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_aide_crond_checking:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron" id="oval:ssg-test_aide_var_cron_checking:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_aide_var_cron_checking:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide daily with cron.(daily|weekly|monthly)" id="oval:ssg-test_aide_crontabs_checking:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_aide_crontabs_checking:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="notify personnel when aide completes" id="oval:ssg-test_aide_scan_notification:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_aide_scan_notification:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="notify personnel when aide completes" id="oval:ssg-test_aide_var_cron_notification:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_aide_var_cron_notification:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="notify personnel when aide completes in cron.(daily|weekly|monthly)" id="oval:ssg-test_aide_crontabs_notification:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_aide_crontabs_notification:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_aide_non_fips_hashes:tst:1" comment="Verify non-FIPS hashes are not configured in /etc/aide.conf" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_aide_non_fips_hashes:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_aide_use_fips_hashes:tst:1" comment="Verify FIPS hashes are configured in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_aide_use_fips_hashes:obj:1"/>
      <ind:state state_ref="oval:ssg-state_aide_use_fips_hashes:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_acls:tst:1" comment="acl is set in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_aide_verify_acls:obj:1"/>
      <ind:state state_ref="oval:ssg-state_aide_verify_acls:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_ext_attributes:tst:1" comment="xattrs is set in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_aide_verify_ext_attributes:obj:1"/>
      <ind:state state_ref="oval:ssg-state_aide_verify_ext_attributes:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_chmod_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_chmod_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit chmod" id="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit chmod" id="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_chmod_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_chmod_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit chmod" id="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit chmod" id="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_chown_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_chown_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit chown" id="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit chown" id="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_chown_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_chown_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit chown" id="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit chown" id="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_fchmod_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fchmod_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchmod" id="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchmod" id="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_fchmod_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fchmod_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchmod" id="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchmod" id="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_fchmodat_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fchmodat_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchmodat" id="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchmodat" id="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_fchmodat_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fchmodat_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchmodat" id="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchmodat" id="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_fchown_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fchown_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchown" id="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchown" id="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_fchown_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fchown_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchown" id="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchown" id="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_fchownat_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fchownat_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchownat" id="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchownat" id="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_fchownat_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fchownat_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchownat" id="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchownat" id="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_fremovexattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fremovexattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fremovexattr" id="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fremovexattr" id="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_fremovexattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fremovexattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fremovexattr" id="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fremovexattr" id="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_fsetxattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fsetxattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fsetxattr" id="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fsetxattr" id="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_fsetxattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_fsetxattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fsetxattr" id="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fsetxattr" id="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_lchown_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_lchown_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit lchown" id="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit lchown" id="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_lchown_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_lchown_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit lchown" id="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit lchown" id="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_lremovexattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_lremovexattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit lremovexattr" id="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit lremovexattr" id="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_lremovexattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_lremovexattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit lremovexattr" id="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit lremovexattr" id="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_lsetxattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_lsetxattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit lsetxattr" id="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit lsetxattr" id="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_lsetxattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_lsetxattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit lsetxattr" id="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctls 64-bit lsetxattr" id="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_removexattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_removexattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit removexattr" id="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit removexattr" id="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_removexattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_removexattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit removexattr" id="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit removexattr" id="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ardm_setxattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_setxattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit setxattr" id="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit setxattr" id="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ardm_setxattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ardm_setxattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit setxattr" id="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit setxattr" id="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_audit_rules_file_deletion_events_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_file_deletion_events_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules file delete" id="oval:ssg-test_audit_rules_file_deletion_events_file_delete_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_file_deletion_events_file_delete_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_audit_rules_file_deletion_events_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_file_deletion_events_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl file delete" id="oval:ssg-test_audit_rules_file_deletion_events_file_delete_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_file_deletion_events_file_delete_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_ari_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ari_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules configuration locked" id="oval:ssg-test_ari_locked_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ari_locked_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_ari_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ari_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl configuration locked" id="oval:ssg-test_ari_locked_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_ari_locked_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_audit_rule_kernel_module_loading_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules insmod" id="oval:ssg-test_audit_rule_kernel_module_loading_insmod_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_insmod_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules rmmod" id="oval:ssg-test_audit_rule_kernel_module_loading_rmmod_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_rmmod_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules modprobe" id="oval:ssg-test_audit_rule_kernel_module_loading_modprobe_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_modprobe_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules module syscalls" id="oval:ssg-test_audit_rule_kernel_module_loading_syscall_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_syscall_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_audit_rule_kernel_module_loading_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl insmod" id="oval:ssg-test_audit_rule_kernel_module_loading_insmod_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_insmod_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl rmmod" id="oval:ssg-test_audit_rule_kernel_module_loading_rmmod_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_rmmod_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl modprobe" id="oval:ssg-test_audit_rule_kernel_module_loading_modprobe_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_modprobe_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl module syscalls" id="oval:ssg-test_audit_rule_kernel_module_loading_syscall_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rule_kernel_module_loading_syscall_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_arle_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arle_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules tallylog" id="oval:ssg-test_arle_tallylog_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arle_tallylog_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules faillock" id="oval:ssg-test_arle_faillock_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arle_faillock_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules lastlog" id="oval:ssg-test_arle_lastlog_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arle_lastlog_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_arle_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arle_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl tallylog" id="oval:ssg-test_arle_tallylog_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arle_tallylog_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl faillock" id="oval:ssg-test_arle_faillock_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arle_faillock_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl lastlog" id="oval:ssg-test_arle_lastlog_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arle_lastlog_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_armm_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_armm_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit selinux changes augenrules" id="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_armm_selinux_watch_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_armm_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_armm_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit selinux changes auditctl" id="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_armm_selinux_watch_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_audit_rules_media_export_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_media_export_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules mount" id="oval:ssg-test_audit_rules_media_export_mount_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_media_export_mount_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_audit_rules_media_export_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_media_export_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl mount" id="oval:ssg-test_audit_rules_media_export_mount_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_media_export_mount_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_arnm_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit network syscalls augenrules" id="oval:ssg-test_arnm_syscall_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_syscall_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/issue augenrules" id="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_etc_issue_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/issue.net augenrules" id="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/hosts augenrules" id="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/sysconfig/network augenrules" id="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_arnm_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit network syscalls auditctl" id="oval:ssg-test_arnm_syscall_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_syscall_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/issue auditctl" id="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_etc_issue_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/issue.net auditctl" id="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/hosts auditctl" id="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/sysconfig/network auditctl" id="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_arpc_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arpc_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="audit augenrules suid sgid" id="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1"/>
      <ind:state state_ref="oval:ssg-state_audit_rules_privileged_commands:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1" comment="audit augenrules binaries count matches rules count" version="1">
      <ind:object object_ref="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1"/>
      <ind:state state_ref="oval:ssg-state_count_of_privileged_commands_having_audit_definition_augenrules:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_arpc_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arpc_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="audit auditctl suid sgid" id="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1"/>
      <ind:state state_ref="oval:ssg-state_audit_rules_privileged_commands:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1" comment="audit auditctl binaries count matches rules count" version="1">
      <ind:object object_ref="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1"/>
      <ind:state state_ref="oval:ssg-state_count_of_privileged_commands_having_audit_definition_auditctl:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_arse_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arse_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules utmp" id="oval:ssg-test_arse_utmp_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arse_utmp_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules btmp" id="oval:ssg-test_arse_btmp_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arse_btmp_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules wtmp" id="oval:ssg-test_arse_wtmp_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arse_wtmp_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_arse_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arse_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl utmp" id="oval:ssg-test_arse_utmp_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arse_utmp_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl btmp" id="oval:ssg-test_arse_btmp_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arse_btmp_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl wtmp" id="oval:ssg-test_arse_wtmp_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arse_wtmp_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_audit_rules_sysadmin_actions_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules sudoers" id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_audit_rules_sysadmin_actions_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl sudoers" id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_art_adjtimex_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_art_adjtimex_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit adjtimex" id="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit adjtimex" id="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_art_adjtimex_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_art_adjtimex_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit adjtimex" id="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit adjtimex" id="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_art_clock_settime_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_art_clock_settime_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit clock_settime" id="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit clock_settime" id="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_art_clock_settime_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_art_clock_settime_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit clock_settime" id="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit clock_settime" id="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_art_settimeofday_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_art_settimeofday_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit settimeofday" id="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit settimeofday" id="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_art_settimeofday_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_art_settimeofday_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit settimeofday" id="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit settimeofday" id="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_art_stime_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_art_stime_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit stime" id="oval:ssg-test_32bit_art_stime_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_art_stime_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_art_stime_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_art_stime_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit stime" id="oval:ssg-test_32bit_art_stime_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_art_stime_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_artw_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_artw_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/localtime watch augenrules" id="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_artw_etc_localtime_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_artw_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_artw_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/localtime watch auditctl" id="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_artw_etc_localtime_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_arufm_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arufm_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eaccess" id="oval:ssg-test_32bit_arufm_eaccess_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_arufm_eaccess_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eaccess" id="oval:ssg-test_64bit_arufm_eaccess_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_arufm_eaccess_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_arufm_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_arufm_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eaccess" id="oval:ssg-test_32bit_arufm_eaccess_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_arufm_eaccess_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eaccess" id="oval:ssg-test_64bit_arufm_eaccess_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_arufm_eaccess_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_audit_rules_usergroup_modification_augenrules:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_augenrules:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/group" id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/passwd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/gshadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/shadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/security/opasswd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_audit_rules_usergroup_modification_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/group" id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/passwd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/gshadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/shadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audit /etc/security/opasswd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="audispd syslog plugin activated" id="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" check="all" check_existence="none_exist" comment="log_group = root" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_conf_log_group_root:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="email account for actions" id="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="test the value of flush parameter in /etc/audit/auditd.conf" id="oval:ssg-test_auditd_data_retention_flush:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_flush:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_flush:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="max log file size" id="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_num_logs:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_num_logs:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2">
      <ind:object object_ref="oval:ssg-object_auditd_data_retention_space_left_action:obj:1"/>
      <ind:state state_ref="oval:ssg-state_auditd_data_retention_space_left_action:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="correct banner in /etc/issue" id="oval:ssg-test_banner_etc_issue:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_banner_etc_issue:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_bootloader_audit_argument:tst:1" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_bootloader_audit_argument:obj:1"/>
      <ind:state state_ref="oval:ssg-state_bootloader_audit_argument:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_bootloader_audit_argument_default:tst:1" comment="check for audit=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_bootloader_audit_argument_default:obj:1"/>
      <ind:state state_ref="oval:ssg-state_bootloader_audit_argument:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" comment="Check for GRUB_DISABLE_RECOVERY=true in /etc/default/grub" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_bootloader_disable_recovery_argument:obj:1"/>
      <ind:state state_ref="oval:ssg-state_bootloader_disable_recovery_argument:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_bootloader_nousb_argument:tst:1" comment="Check for 'nousb' argument in /etc/default/grub" check="all" check_existence="all_exist" version="1">
      <ind:object object_ref="oval:ssg-object_bootloader_nousb_argument:obj:1"/>
      <ind:state state_ref="oval:ssg-state_bootloader_nousb_argument:ste:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="none_exist" comment="/boot/grub2/grub.cfg does not exist" id="oval:ssg-test_bootloader_grub_cfg:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_bootloader_grub_cfg:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser is defined in /boot/grub2/grub.cfg files. Superuser is not root, admin, or administrator" id="oval:ssg-test_bootloader_superuser:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_bootloader_superuser:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in /boot/grub2/grub.cfg" id="oval:ssg-test_bootloader_password:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_bootloader_password:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="none_exist" comment="/boot/efi/EFI/redhat/grub.cfg does not exist" id="oval:ssg-test_bootloader_uefi_grub_cfg:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_bootloader_uefi_grub_cfg:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser is defined in /boot/efi/EFI/redhat/grub.cfg. Superuser is not root, admin, or administrator" id="oval:ssg-test_bootloader_uefi_superuser:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_bootloader_uefi_superuser:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in /boot/efi/EFI/redhat/grub.cfg" id="oval:ssg-test_bootloader_uefi_password:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_bootloader_uefi_password:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable Browsing" id="oval:ssg-test_cups_disable_browsing_browsing_off:tst:1" version="2">
      <ind:object object_ref="oval:ssg-obj_cups_disable_browsing_browsing_off:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Do not allow incoming printer information packets" id="oval:ssg-test_cups_disable_browsing_browseallow:tst:1" version="2">
      <ind:object object_ref="oval:ssg-obj_cups_disable_browsing_browseallow:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Disable the more general port directive" id="oval:ssg-test_cups_disable_printserver_disable_port:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_cups_disable_printserver_disable_port:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Listen only at the localhost level" id="oval:ssg-test_cups_disable_printserver_use_listen:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_cups_disable_printserver_use_listen:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI banner is enabled" id="oval:ssg-test_banner_gui_enabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_banner_gui_enabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI banner cannot be changed by user" id="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable automount in GNOME3" id="oval:ssg-test_dconf_gnome_disable_automount:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from changing automount setting" id="oval:ssg-test_prevent_user_gnome_automount:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_automount:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable automount-open in GNOME" id="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from changing automount-open setting" id="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable autorun in GNOME" id="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from changing autorun setting" id="oval:ssg-test_prevent_user_gnome_autorun:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_autorun:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable Ctrl-Alt-Del" id="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of ctrl-alt-del keys" id="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable system geolocation" id="oval:ssg-test_disable_sys_geolocation:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_sys_geolocation:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of system geolocation" id="oval:ssg-test_prevent_user_sys_geolocation:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_sys_geolocation:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable clock geolocation" id="oval:ssg-test_disable_clock_geolocation:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_clock_geolocation:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of clock geolocation" id="oval:ssg-test_prevent_user_clock_geolocation:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_clock_geolocation:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable power settings" id="oval:ssg-test_disable_gnome_power_setting:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_gnome_power_setting:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of power settings" id="oval:ssg-test_prevent_user_power_setting_change:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_power_setting_change:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI restart and shutdown buttons are disabled" id="oval:ssg-test_disable_restart_buttons:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_restart_buttons:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI restart and shutdown buttons cannot be enabled" id="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable thumbnailers in GNOME3" id="oval:ssg-test_gnome_disable_thumbnailers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_gnome_disable_thumbnailers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot enable thumbnailers " id="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_change_gnome_thumbnailers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable user administration" id="oval:ssg-test_disable_gnome_user_admin:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_gnome_user_admin:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of user administration" id="oval:ssg-test_prevent_user_enable_admin:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_enable_admin:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI user list is disabled" id="oval:ssg-test_disable_user_list:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_user_list:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI user list cannot be enabled" id="oval:ssg-test_prevent_user_disable_user_list:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_disable_user_list:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable wifi creation" id="oval:ssg-test_disable_wifi_creation:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_wifi_creation:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of wifi creation capability" id="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_enable_wifi_creation:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable wifi notification" id="oval:ssg-test_disable_wifi_notification:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_wifi_notification:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of wifi notification capability" id="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_enable_wifi_notification:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Enable GUI Login Smartcard authentication" id="oval:ssg-test_enable_gnome_smartcard:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_enable_gnome_smartcard:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI smartcard authentication cannot be disabled" id="oval:ssg-test_prevent_user_disable_smartcard:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_disable_smartcard:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI banner cannot be changed by user" id="oval:ssg-test_prevent_user_banner_change:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_banner_change:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="login banner text is correctly set" id="oval:ssg-test_gdm_login_banner_text_setting:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_gdm_login_banner_text_setting:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gdm_login_banner_text_setting:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Set number of login tries" id="oval:ssg-test_configure_allowed_failures:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_configure_allowed_failures:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="number of login attempts cannot be changed" id="oval:ssg-test_prevent_user_allowed-failures_change:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_allowed-failures_change:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="configure remote access credentials" id="oval:ssg-test_configure_remote_access_creds:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_configure_remote_access_creds:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="prevent user from disabling remote access credential requirements" id="oval:ssg-test_prevent_user_remote_access_creds:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_remote_access_creds:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="configure remote access encryption" id="oval:ssg-test_configure_remote_access_encryption:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_configure_remote_access_encryption:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="prevent user from disabling remote access encryption" id="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="idle delay is configured" id="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot change idle_activation_enabled" id="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver idle delay is configured" id="oval:ssg-test_screensaver_idle_delay:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_screensaver_idle_delay:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot change screensaver idle delay" id="oval:ssg-test_prevent_user_change_idle_delay:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_change_idle_delay:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver idle delay setting is correct" id="oval:ssg-test_screensaver_idle_delay_setting:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_screensaver_idle_delay_setting:obj:1"/>
      <ind:state state_ref="oval:ssg-state_screensaver_idle_delay_setting:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock is set correctly" id="oval:ssg-test_screensaver_lock_delay:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_screensaver_lock_delay:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock delay cannot be changed by user" id="oval:ssg-test_prevent_user_lock_delay:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_lock_delay:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock is enabled" id="oval:ssg-test_screensaver_lock_enabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_screensaver_lock_enabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock cannot be changed by user" id="oval:ssg-test_prevent_user_screensaver_lock:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_screensaver_lock:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver mode is blank" id="oval:ssg-test_screensaver_mode_blank:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_screensaver_mode_blank:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="blank screensaver cannot be changed by user" id="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver user info is disabled" id="oval:ssg-test_screensaver_disable_user_info:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_screensaver_disable_user_info:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver prevent user from changing" id="oval:ssg-test_prevent_user_info_change:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_prevent_user_info_change:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot change screensaver idle delay" id="oval:ssg-test_user_change_idle_delay_lock:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_user_change_idle_delay_lock:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock delay cannot be changed by user" id="oval:ssg-test_user_change_lock_delay_lock:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_user_change_lock_delay_lock:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing directory permissions" id="oval:ssg-test_dir_perms_etc_httpd_conf:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_dir_perms_etc_httpd_conf:obj:1"/>
      <unix:state state_ref="oval:ssg-state_dir_perms_etc_httpd_conf:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing directory permissions" id="oval:ssg-test_dir_perms_var_log_httpd:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_dir_perms_var_log_httpd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_dir_perms_var_log_httpd:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="all local world-writable directories have sticky bit set" id="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_only_local_directories:obj:1"/>
      <unix:state state_ref="oval:ssg-state_world_writable_and_not_sticky:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" comment="check for local directories that are world writable and have uid greater than or equal to 1000" id="oval:ssg-test_dir_world_writable_uid_gt_1000:tst:1" version="1">
      <unix:object object_ref="oval:ssg-all_local_directories:obj:1"/>
      <unix:state state_ref="oval:ssg-state_gid_is_user_and_world_writable:ste:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="sshd HostbasedAuthentication" id="oval:ssg-test_sshd_hostbasedauthentication:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_sshd_hostbasedauthentication:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_disable_interactive_boot_grub_cmdline_linux:tst:1" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_disable_interactive_boot_grub_cmdline_linux:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_disable_interactive_boot_grub_cmdline_linux_default:tst:1" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_disable_interactive_boot_grub_cmdline_linux_default:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests whether prelinking is disabled" id="oval:ssg-test_prelinking_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_prelinking_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" id="oval:ssg-test_core_dumps_limitsconf:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_core_dumps_limitsconf:obj:1"/>
      <ind:state state_ref="oval:ssg-state_core_dumps_limitsconf:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="Check the pam_lastlog configuration of /etc/pam.d/postlogin" id="oval:ssg-test_display_login_attempts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_display_login_attempts:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="dconf user profile exists" id="oval:ssg-test_dconf_user_profile:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_dconf_user_profile:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found" id="oval:ssg-test_selinux_default_grub:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_selinux_default_grub:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found" id="oval:ssg-test_selinux_grub2_cfg:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_selinux_grub2_cfg:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check value selinux|enforcing=0 in /etc/grub.d fail if found" id="oval:ssg-test_selinux_grub_dir:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_selinux_grub_dir:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/yum.conf" id="oval:ssg-test_yum_ensure_gpgcheck_globally_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_globally_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/dnf/dnf.conf" id="oval:ssg-test_dnf_ensure_gpgcheck_globally_activated:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_dnf_ensure_gpgcheck_globally_activated:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for existence of gpgcheck=0 in /etc/yum.repos.d/ files" id="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the presence of daily setting in /etc/logrotate.conf file" id="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_logrotate_conf_daily_setting:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the existence of /etc/cron.daily/logrotate file (and verify it actually calls logrotate utility)" id="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_cron_daily_logrotate_existence:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-fd431d51-4ae0493b_installed:tst:1" version="1" comment="Red Hat release key package is installed">
      <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
      <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-fd431d51-4ae0493b:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-2fa658e0-45700c69_installed:tst:1" version="1" comment="Red Hat auxiliary key package is installed">
      <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
      <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-2fa658e0-45700c69:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-f4a80eb5-53a7ff4b_installed:tst:1" version="1" comment="CentOS7 key package is installed">
      <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
      <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-f4a80eb5-53a7ff4b:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-c105b9de-4e0fd3a3_installed:tst:1" version="1" comment="CentOS6 key package is installed">
      <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
      <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-c105b9de-4e0fd3a3:ste:1"/>
    </linux:rpminfo_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/boot/grub2/grub.cfg owned by root" id="oval:ssg-test_file_group_owner_grub2_cfg:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_group_owner_grub2_cfg:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_group_owner_grub2_cfg:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.cfg owned by root" id="oval:ssg-test_file_group_owner_efi_grub2_cfg:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_group_owner_efi_grub2_cfg:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_group_owner_grub2_cfg:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership" id="oval:ssg-test_file_groupowner_etc_group:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_groupowner_etc_group:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_groupowner_etc_group:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="oval:ssg-test_file_groupowner_etc_gshadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_groupowner_etc_gshadow:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_groupowner_etc_gshadow:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /etc/passwd" id="oval:ssg-test_file_groupowner_etc_passwd:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_groupowner_etc_passwd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_groupowner_etc_passwd:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership" id="oval:ssg-test_file_owner_etc_group:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_owner_etc_group:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_owner_etc_group:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="oval:ssg-test_file_owner_etc_gshadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_owner_etc_gshadow:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_owner_etc_gshadow:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership" id="oval:ssg-test_file_owner_etc_passwd:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_owner_etc_passwd:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_owner_etc_passwd:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="binary directories uid root" id="oval:ssg-test_ownership_binary_directories:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_ownership_binary_directories:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="binary files uid root" id="oval:ssg-test_ownership_binary_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_ownership_binary_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="library directories uid root" id="oval:ssg-test_ownership_lib_dir:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_ownership_lib_dir:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="library files uid root" id="oval:ssg-test_ownership_lib_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_ownership_lib_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="binary files go-w" id="oval:ssg-test_perms_binary_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_binary_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing /etc/group permissions" id="oval:ssg-test_file_permissions_etc_group:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_etc_group:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_permissions_etc_group:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/gshadow mode and ownership" id="oval:ssg-test_etc_gshadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_gshadow:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_gid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_gshadow_state_mode_0000:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/passwd mode and ownership" id="oval:ssg-test_etc_passwd:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_passwd:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_gid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_passwd_state_mode_0644_or_stronger:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/shadow mode and ownership" id="oval:ssg-test_etc_shadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_etc_shadow:obj:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_uid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_gid_0:ste:1"/>
      <unix:state state_ref="oval:ssg-_etc_shadow_state_mode_0000:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing file permissions" id="oval:ssg-test_file_permissions_grub2_cfg:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_grub2_cfg:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_permissions_grub2_cfg:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.cfg owned by root" id="oval:ssg-test_file_permissions_efi_grub2_cfg:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_efi_grub2_cfg:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_permissions_grub2_cfg:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_home_dirs:obj:1"/>
      <unix:state state_ref="oval:ssg-state_home_dirs_wrong_perm:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/etc/httpd/conf/* permissions" id="oval:ssg-test_file_permissions_httpd_server_conf_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_httpd_server_conf_files:obj:1"/>
      <unix:state state_ref="oval:ssg-state_wrong_file_permissions_httpd_server_conf_files:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="library directories go-w" id="oval:ssg-test_perms_lib_dir:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_lib_dir:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="library files go-w" id="oval:ssg-test_perms_lib_files:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_lib_files:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="none_exist" comment="world writable files" id="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" comment="files with no group owner" check_existence="none_exist" id="oval:ssg-test_file_permissions_ungroupowned:tst:1" version="1">
      <!-- OVAL 5.11 rc-2 within the effort to add oval-def:NotesType construct also to variables
         moved NotesType construct to the oval-common-schema:
         [1] https://github.com/OVALProject/Language/issues/6
         [2] https://github.com/OVALProject/Language/commit/c34abb871ee446d9fd9e50a8ccbc8a8e2af5db20
         But this change broke backward-compatibility as reported in:
         [3] https://github.com/OVALProject/Language/issues/237
         [4] http://making-security-measurable.1364806.n2.nabble.com/5-11-backwards-incompatibility-issue-Suspect-the-fix-for-issue-6-was-the-culprit-tp7586190.html
         Therefore as a temporary workaround to have both OVAL 5.10 and also OVAL 5.11 valid content,
         temporarily comment out the <notes> construct below till the issue [3] is fixed in OVAL 5.11.1
         version.
    <notes>
      <note>This will enumerate all files on local partitions</note>
    </notes> -->
      <unix:object object_ref="oval:ssg-object_file_permissions_ungroupowned:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0640" id="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_var_log_audit_files-non_root:obj:1"/>
      <unix:state state_ref="oval:ssg-state_not_mode_0640:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0600" id="oval:ssg-test_file_permissions_var_log_audit:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_var_log_audit_files:obj:1"/>
      <unix:state state_ref="oval:ssg-state_not_mode_0600:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/boot/grub2/grub.cfg owned by root" id="oval:ssg-test_file_user_owner_grub2_cfg:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_user_owner_grub2_cfg:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_user_owner_grub2_cfg:ste:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.cfg owned by root" id="oval:ssg-test_file_user_owner_efi_grub2_cfg:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_user_owner_efi_grub2_cfg:obj:1"/>
      <unix:state state_ref="oval:ssg-state_file_user_owner_grub2_cfg:ste:1"/>
    </unix:file_test>
    <ind:xmlfilecontent_test check="all" check_existence="none_exist" comment="ssh service is not enabled in services" id="oval:ssg-test_firewalld_service_sshd:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_firewalld_service_sshd:obj:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="none_exist" comment="ssh port is not enabled in services" id="oval:ssg-test_firewalld_service_sshd_port:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_firewalld_service_sshd_port:obj:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="none_exist" comment="ssh service is not enabled in zones" id="oval:ssg-test_firewalld_zone_sshd:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_firewalld_zone_sshd:obj:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="none_exist" comment="ssh port is not enabled in zones" id="oval:ssg-test_firewalld_zone_sshd_port:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_firewalld_zone_sshd_port:obj:1"/>
    </ind:xmlfilecontent_test>
    <ind:xmlfilecontent_test check="all" check_existence="all_exist" comment="ssh service is enabled in services" id="oval:ssg-test_firewalld_service_sshd_enabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_firewalld_service_sshd_enabled:obj:1"/>
    </ind:xmlfilecontent_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="ssh port is enabled in services" id="oval:ssg-test_firewalld_service_sshd_port_enabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_firewalld_service_sshd_port_enabled:obj:1"/>
      <ind:state state_ref="oval:ssg-state_sshd_listening_port:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:xmlfilecontent_test check="all" check_existence="all_exist" comment="ssh service is enabled in zones" id="oval:ssg-test_firewalld_zone_sshd_enabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_firewalld_zone_sshd_enabled:obj:1"/>
    </ind:xmlfilecontent_test>
    <ind:textfilecontent54_test check="all" check_existence="any_exist" comment="ssh port is enabled in zones" id="oval:ssg-test_firewalld_zone_sshd_port_enabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_firewalld_zone_sshd_port_enabled:obj:1"/>
      <ind:state state_ref="oval:ssg-state_sshd_listening_port:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_enable:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_enable:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_format:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_format:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_protocol:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Banner for FTP Users" id="oval:ssg-test_ftp_present_banner:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_test_ftp_present_banner:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_gid_passwd_group_same:tst:1" check="all" check_existence="all_exist" comment="Verify all GIDs referenced in /etc/passwd are defined in /etc/group" version="1">
      <ind:object object_ref="oval:ssg-object_gid_passwd_group_same:obj:1"/>
      <ind:state state_ref="oval:ssg-state_gid_passwd_group_same:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable GDM Automatic Login" id="oval:ssg-test_disable_automatic_login:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_automatic_login:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable GDM Guest Login" id="oval:ssg-test_disable_guest_login:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_disable_guest_login:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership /etc/shadow" id="oval:ssg-test_groupowner_etc_shadow:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_groupowner_shadow_file:obj:1"/>
      <unix:state state_ref="oval:ssg-state_groupowner_shadow_file:ste:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/selinux/enforce is 1" id="oval:ssg-test_selinux_enforcing:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_selinux_enforcing:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" comment="AntiVirus package is installed">
      <linux:object object_ref="oval:ssg-obj_linuxshield_install_antivirus:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" comment="Runtime Libraries package is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_runtime_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_management_agent:tst:1" version="1" comment="Agent package is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_management_agent:obj:1"/>
    </linux:rpminfo_test>
    <unix:file_test check="all" check_existence="all_exist" comment="McAfee ACCM installed" id="oval:ssg-test_mcafee_accm_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_mcafee_accm_exists:obj:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_hbss_hips_installed:tst:1" version="1" comment="McAfee IPS is installed">
      <linux:object object_ref="oval:ssg-obj_mcafee_hbss_hips_installed:obj:1"/>
    </linux:rpminfo_test>
    <unix:file_test check="all" check_existence="all_exist" comment="McAfee Policy Auditor installed" id="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_mcafee_auditengine_exists:obj:1"/>
    </unix:file_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 6" id="oval:ssg-test_centos6:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_centos6:obj:1"/>
      <linux:state state_ref="oval:ssg-state_centos6:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 7" id="oval:ssg-test_centos7:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_centos7:obj:1"/>
      <linux:state state_ref="oval:ssg-state_centos7:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="only_one_exists" comment="fedora-release RPM package is installed" id="oval:ssg-test_fedora_release_rpm:tst:1" version="1">
      <linux:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
    </linux:rpminfo_test>
    <ind:textfilecontent54_test check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora" id="oval:ssg-test_fedora_vendor_product:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:family_test id="oval:ssg-test_unix_family:tst:1" check="all" check_existence="at_least_one_exists" comment="Test installed OS is part of the unix family" version="1">
      <ind:object object_ref="oval:ssg-object_unix_family:obj:1"/>
      <ind:state state_ref="oval:ssg-state_unix_family:ste:1"/>
    </ind:family_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 6" id="oval:ssg-test_rhel_workstation:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_workstation:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_workstation:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 6" id="oval:ssg-test_rhel_server:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_server:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_server:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 6" id="oval:ssg-test_rhel_computenode:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel_computenode:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel_computenode:ste:1"/>
    </linux:rpminfo_test>
    <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel7_unix_family:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
      <ind:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
    </ind:family_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 7" id="oval:ssg-test_rhel7_workstation:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 7" id="oval:ssg-test_rhel7_server:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 7" id="oval:ssg-test_rhel7_computenode:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
      <linux:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 6" id="oval:ssg-test_sl6:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_sl6:obj:1"/>
      <linux:state state_ref="oval:ssg-state_sl6:ste:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 7" id="oval:ssg-test_sl7:tst:1" version="1">
      <linux:object object_ref="oval:ssg-obj_sl7:obj:1"/>
      <linux:state state_ref="oval:ssg-state_sl7:ste:1"/>
    </linux:rpminfo_test>
    <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_unix_wrlinux:obj:1"/>
      <ind:state state_ref="oval:ssg-state_unix_wrlinux:ste:1"/>
    </ind:family_test>
    <unix:file_test check_existence="at_least_one_exists" version="1" id="oval:ssg-test_wrlinux:tst:1" check="all" comment="Test presence of /etc/wrlinux-release.">
      <unix:object object_ref="oval:ssg-obj_test_wrlinux:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_disabled:tst:1" version="1" check="all" comment="kernel module dccp disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_dccp_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" version="1" check="all" comment="kernel module dccp disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /etc/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_dccp_etcmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /run/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_dccp_runmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /usr/lib/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_dccp_libmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" version="1" check="all" comment="kernel module usb-storage disabled">
      <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /etc/modprobe.conf">
      <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /etc/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_etcmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /run/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_runmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d">
      <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_libmodules-load:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the value of the ssl start_tls setting in the /etc/nslcd.conf file" id="oval:ssg-test_ldap_client_start_tls_ssl:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ldap_client_start_tls_ssl:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the value of the tls_cacertdir setting in the /etc/nslcd.conf file" id="oval:ssg-test_ldap_client_tls_cacertdir:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ldap_client_tls_cacertdir:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Tests the value of the tls_cacertfile setting in the /etc/nslcd.conf file" id="oval:ssg-test_ldap_client_tls_cacertfile:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_ldap_client_tls_cacertfile:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="oval:ssg-test_logwatch_configured_hostlimit:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_logwatch_configured_hostlimit:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="oval:ssg-test_logwatch_configured_splithosts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_logwatch_configured_splithosts:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nodev_dev_shm:tst:1" version="1" comment="nodev on /dev/shm">
      <linux:object object_ref="oval:ssg-object_dev_shm_partition_nodev:obj:1"/>
      <linux:state state_ref="oval:ssg-state_dev_shm_nodev:ste:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_noexec_dev_shm:tst:1" version="1" comment="noexec on /dev/shm">
      <linux:object object_ref="oval:ssg-object_dev_shm_partition_noexec:obj:1"/>
      <linux:state state_ref="oval:ssg-state_dev_shm_noexec:ste:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nosuid_dev_shm:tst:1" version="1" comment="nosuid on /dev/shm">
      <linux:object object_ref="oval:ssg-object_dev_shm_partition_nosuid:obj:1"/>
      <linux:state state_ref="oval:ssg-state_dev_shm_nosuid:ste:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" version="1" comment="nodev on local filesystems">
      <linux:object object_ref="oval:ssg-object_non_root_partitions:obj:1"/>
      <linux:state state_ref="oval:ssg-state_local_nodev:ste:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="all nfs has nodev" id="oval:ssg-test_nfs_nodev_etc_fstab:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_nfs_nodev_etc_fstab:obj:1"/>
      <ind:state state_ref="oval:ssg-state_remote_filesystem_nodev:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="no nfs" id="oval:ssg-test_no_nfs_defined_etc_fstab_nodev:tst:1" version="1">
      <!-- this test returns 'true' if /etc/fstab does not contain nfs/nfs4 mounts -->
      <ind:object object_ref="oval:ssg-object_no_nfs_defined_etc_fstab_nodev:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" check="all" comment="'nodev' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_nodev_runtime_cd_dvd_drive:tst:1" check="all" comment="'nodev' mount option used for at least one CD / DVD drive alternative names in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_nodev_runtime_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'nodev' mount option in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_nodev_runtime_not_cd_dvd_drive:tst:1" check="all" check_existence="all_exist" comment="'nodev' mount option used for removable partition in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_nodev_runtime_not_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" check="all" comment="'noexec' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_noexec_runtime_cd_dvd_drive:tst:1" check="all" comment="'noexec' mount option used for at least one CD / DVD drive alternative names in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_noexec_runtime_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'noexec' mount option in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_noexec_runtime_not_cd_dvd_drive:tst:1" check="all" check_existence="all_exist" comment="'noexec' mount option used for removable partition in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_noexec_runtime_not_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="all nfs has nosuid" id="oval:ssg-test_nfs_nosuid_etc_fstab:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_nfs_nosuid_etc_fstab:obj:1"/>
      <ind:state state_ref="oval:ssg-state_remote_filesystem_nosuid:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="no nfs" id="oval:ssg-test_no_nfs_defined_etc_fstab_nosuid:tst:1" version="1">
      <!-- this test returns 'true' if /etc/fstab does not contain nfs/nfs4 mounts -->
      <ind:object object_ref="oval:ssg-object_no_nfs_defined_etc_fstab_nosuid:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" check="all" comment="'nosuid' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_nosuid_runtime_cd_dvd_drive:tst:1" check="all" comment="'nosuid' mount option used for at least one CD / DVD drive alternative names in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_nosuid_runtime_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'nosuid' mount option in /etc/fstab" version="1">
      <ind:object object_ref="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test id="oval:ssg-test_nosuid_runtime_not_cd_dvd_drive:tst:1" check="all" check_existence="all_exist" comment="'nosuid' mount option used for removable partition in runtime configuration" version="1">
      <linux:object object_ref="oval:ssg-object_nosuid_runtime_not_cd_dvd_drive:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for no cifs in /etc/fstab" id="oval:ssg-test_20340111:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_20340111:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check for sec=krb5i or sec=ntlmv2i in /etc/fstab" id="oval:ssg-test_20340112:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_20340111:obj:1"/>
      <ind:state state_ref="oval:ssg-state_20340112:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for no cifs in /etc/mtab" id="oval:ssg-test_20340113:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_20340112:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check for sec=krb5i or sec=ntlmv2i in /etc/mtab" id="oval:ssg-test_20340114:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_20340112:obj:1"/>
      <ind:state state_ref="oval:ssg-state_20340112:ste:1"/>
    </ind:textfilecontent54_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nodev_tmp:tst:1" version="1" comment="nodev on /tmp">
      <linux:object object_ref="oval:ssg-object_tmp_nodev_partition:obj:1"/>
      <linux:state state_ref="oval:ssg-state_tmp_nodev:ste:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_noexec_tmp:tst:1" version="1" comment="noexec on /tmp">
      <linux:object object_ref="oval:ssg-object_tmp_noexec_partition:obj:1"/>
      <linux:state state_ref="oval:ssg-state_tmp_noexec:ste:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nosuid_tmp:tst:1" version="1" comment="nosuid on /tmp">
      <linux:object object_ref="oval:ssg-object_tmp_nosuid_partition:obj:1"/>
      <linux:state state_ref="oval:ssg-state_tmp_nosuid:ste:1"/>
    </linux:partition_test>
    <linux:partition_test id="oval:ssg-test_mount_option_var_tmp:tst:1" version="1" comment="Ensure /var/tmp is mounted" check="all">
      <linux:object object_ref="oval:ssg-object_mount_option_var_tmp:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure bind mount option is on /var/tmp" id="oval:ssg-test_mount_option_var_tmp_bind:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_mount_option_var_tmp_bind:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check NOZEROCONF=yes in /etc/sysconfig/network" id="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Define default gateways" id="oval:ssg-test_network_ipv6_default_gateway:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_ipv6_default_gateway:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test for udp6 based rpc services" id="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test for tcp6 based rpc services" id="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Enable privacy extensions on each interface" id="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Set static IPv6 address on each interface" id="oval:ssg-test_network_ipv6_static_address:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_network_ipv6_static_address:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:interface_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_promisc_interfaces:tst:1" version="1" comment="random">
      <unix:object object_ref="oval:ssg-object_promisc_interfaces:obj:1"/>
      <unix:state state_ref="oval:ssg-state_promisc:ste:1"/>
    </unix:interface_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/etc/securetty file exists" id="oval:ssg-test_etc_securetty_exists:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_securetty_exists:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="no entries in /etc/securetty" id="oval:ssg-test_no_direct_root_logins:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_no_direct_root_logins:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="make sure nullok is not used in /etc/pam.d/system-auth" id="oval:ssg-test_no_empty_passwords:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_no_empty_passwords:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="none_exist" comment="Check user ids on all files on the system" id="oval:ssg-no_files_unowned_by_user_test:tst:1" version="1">
      <unix:object object_ref="oval:ssg-file_permissions_unowned_object:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the insecure locks in /etc/exports" id="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_no_insecure_locks_exports:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .netrc in /home" id="oval:ssg-test_no_netrc_files_home:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_netrc_files_home:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .rhosts or .shosts in /root" id="oval:ssg-test_no_rsh_trust_files_root:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_root:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .rhosts or .shosts in /home" id="oval:ssg-test_no_rsh_trust_files_home:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_home:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for /etc/hosts.equiv or /etc/shosts.equiv" id="oval:ssg-test_no_rsh_trust_files_etc:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_etc:obj:1"/>
    </unix:file_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_default_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;0, UID_MIN - 1&gt; system UIDs having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_default_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_default_uid_range:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_min_not_defined:tst:1" comment="SYS_UID_MIN not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_max_not_defined:tst:1" comment="SYS_UID_MAX not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
      <ind:object object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;0, SYS_UID_MIN&gt; system UIDs having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_reserved_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_reserved_uid_range:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" check="all" check_existence="all_exist" comment="&lt;SYS_UID_MIN, SYS_UID_MAX&gt; system UIDS having shell set" version="1">
      <ind:object object_ref="oval:ssg-object_shell_defined_dynalloc_uid_range:obj:1"/>
      <ind:state state_ref="oval:ssg-state_shell_defined_dynalloc_uid_range:ste:1"/>
    </ind:variable_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_dracut-fips_installed:tst:1" version="1" comment="package dracut-fips is installed">
      <linux:object object_ref="oval:ssg-obj_package_dracut-fips_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_gdm_installed:tst:1" version="1" comment="package gdm is installed">
      <linux:object object_ref="oval:ssg-obj_package_gdm_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_libreswan_installed:tst:1" version="1" comment="package libreswan is installed">
      <linux:object object_ref="oval:ssg-obj_package_libreswan_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_mcstrans_removed:tst:1" version="1" comment="package mcstrans is removed">
      <linux:object object_ref="oval:ssg-obj_package_mcstrans_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_nss-pam-ldapd_removed:tst:1" version="1" comment="package nss-pam-ldapd is removed">
      <linux:object object_ref="oval:ssg-obj_package_nss-pam-ldapd_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_openldap-servers_removed:tst:1" version="1" comment="package openldap-servers is removed">
      <linux:object object_ref="oval:ssg-obj_package_openldap-servers_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_prelink_removed:tst:1" version="1" comment="package prelink is removed">
      <linux:object object_ref="oval:ssg-obj_package_prelink_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_rsh-server_removed:tst:1" version="1" comment="package rsh-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_rsh-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_rsh_removed:tst:1" version="1" comment="package rsh is removed">
      <linux:object object_ref="oval:ssg-obj_package_rsh_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" comment="package rsyslog is installed">
      <linux:object object_ref="oval:ssg-obj_package_rsyslog_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_samba-common_installed:tst:1" version="1" comment="package samba-common is installed">
      <linux:object object_ref="oval:ssg-obj_package_samba-common_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_samba-common_removed:tst:1" version="1" comment="package samba-common is removed">
      <linux:object object_ref="oval:ssg-obj_package_samba-common_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_screen_installed:tst:1" version="1" comment="package screen is installed">
      <linux:object object_ref="oval:ssg-obj_package_screen_installed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_sendmail_removed:tst:1" version="1" comment="package sendmail is removed">
      <linux:object object_ref="oval:ssg-obj_package_sendmail_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_setroubleshoot_removed:tst:1" version="1" comment="package setroubleshoot is removed">
      <linux:object object_ref="oval:ssg-obj_package_setroubleshoot_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_talk-server_removed:tst:1" version="1" comment="package talk-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_talk-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_talk_removed:tst:1" version="1" comment="package talk is removed">
      <linux:object object_ref="oval:ssg-obj_package_talk_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnet-server_removed:tst:1" version="1" comment="package telnet-server is removed">
      <linux:object object_ref="oval:ssg-obj_package_telnet-server_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnet_removed:tst:1" version="1" comment="package telnet is removed">
      <linux:object object_ref="oval:ssg-obj_package_telnet_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_tftp_removed:tst:1" version="1" comment="package tftp is removed">
      <linux:object object_ref="oval:ssg-obj_package_tftp_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" version="1" comment="package xorg-x11-server-common is removed">
      <linux:object object_ref="oval:ssg-obj_package_xorg-x11-server-common_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_ypserv_removed:tst:1" version="1" comment="package ypserv is removed">
      <linux:object object_ref="oval:ssg-obj_package_ypserv_removed:obj:1"/>
    </linux:rpminfo_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_home_partition:tst:1" version="1" comment="/home on own partition">
      <linux:object object_ref="oval:ssg-object_mount_home_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_tmp_partition:tst:1" version="1" comment="/tmp on own partition">
      <linux:object object_ref="oval:ssg-object_own_tmp_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_partition:tst:1" version="1" comment="/var on own partition">
      <linux:object object_ref="oval:ssg-object_mount_var_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_partition:tst:1" version="1" comment="/var/log on own partition">
      <linux:object object_ref="oval:ssg-object_mount_var_log_own_partition:obj:1"/>
    </linux:partition_test>
    <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_audit_partition:tst:1" version="1" comment="check for /var/log/audit partition">
      <linux:object object_ref="oval:ssg-object_mount_var_log_audit_own_partition:obj:1"/>
    </linux:partition_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Set banner" id="oval:ssg-test_postfix_server_banner:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_postfix_server_banner:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test id="oval:ssg-test_removable_partition_doesnt_exist:tst:1" check="all" check_existence="none_exist" comment="Check if expected removable partitions truly exist on the system" version="1">
      <unix:object object_ref="oval:ssg-object_removable_partition_doesnt_exist:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that /sbin/sulogin was not removed from the default systemd rescue.service to ensure that a   password must be entered to access single user mode" id="oval:ssg-test_require_rescue_service:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_require_rescue_service:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that the systemd rescue.service is in the runlevel1.target" id="oval:ssg-test_require_rescue_service_runlevel1:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_require_rescue_service_runlevel1:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for rescue.service in /etc/systemd/system" id="oval:ssg-test_no_custom_rescue_service:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_custom_rescue_service:obj:1"/>
    </unix:file_test>
    <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for runlevel1.target in /etc/systemd/system" id="oval:ssg-test_no_custom_runlevel1_target:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_no_custom_runlevel1_target:obj:1"/>
    </unix:file_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check for client signing = mandatory in /etc/samba/smb.conf" id="oval:ssg-test_require_smb_client_signing:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_require_smb_client_signing:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="serial ports /etc/securetty" id="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_serial_ports_etc_securetty:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH starts with : or ." id="oval:ssg-test_env_var_begins:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_begins_colon_period:ste:1"/>
    </ind:environmentvariable58_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH doesn't contain : twice in a row" id="oval:ssg-test_env_var_contains_doublecolon:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_contains_double_colon:ste:1"/>
    </ind:environmentvariable58_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH doesn't contain . twice in a row" id="oval:ssg-test_env_var_contains_doubleperiod:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_contains_double_period:ste:1"/>
    </ind:environmentvariable58_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH ends with : or ." id="oval:ssg-test_env_var_ends:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_ends_colon_period:ste:1"/>
    </ind:environmentvariable58_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH starts with an absolute path /" id="oval:ssg-test_env_var_begins_slash:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_begins_slash:ste:1"/>
    </ind:environmentvariable58_test>
    <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH contains relative paths" id="oval:ssg-test_env_var_contains_relative_path:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
      <ind:state state_ref="oval:ssg-state_contains_relative_path:ste:1"/>
    </ind:environmentvariable58_test>
    <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_files_fail_md5_hash:tst:1" version="1" check="all" comment="verify file md5 hashes">
      <linux:object object_ref="oval:ssg-object_files_fail_md5_hash:obj:1"/>
    </linux:rpmverifyfile_test>
    <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_verify_all_rpms_user_ownership:tst:1" version="1" check="all" comment="user ownership of all files matches local rpm database">
      <linux:object object_ref="oval:ssg-object_files_fail_user_ownership:obj:1"/>
    </linux:rpmverifyfile_test>
    <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_verify_all_rpms_group_ownership:tst:1" version="1" check="all" comment="group ownership of all files matches local rpm database">
      <linux:object object_ref="oval:ssg-object_files_fail_group_ownership:obj:1"/>
    </linux:rpmverifyfile_test>
    <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_verify_all_rpms_mode:tst:1" version="1" check="all" comment="mode of all files matches local rpm database">
      <linux:object object_ref="oval:ssg-object_files_fail_mode:obj:1"/>
    </linux:rpmverifyfile_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $UDPServerRun | $InputRELPServerRun" id="oval:ssg-test_rsyslog_nolisten:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_rsyslog_nolisten:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_d:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_d:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="virtual consoles /etc/securetty" id="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_virtual_consoles_etc_securetty:obj:1"/>
    </ind:textfilecontent54_test>
    <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="device_t in /dev" id="oval:ssg-test_selinux_all_devicefiles_labeled:tst:1" version="2">
      <linux:object object_ref="oval:ssg-object_selinux_all_devicefiles_labeled:obj:1"/>
      <linux:state state_ref="oval:ssg-state_selinux_all_devicefiles_labeled:ste:1"/>
    </linux:selinuxsecuritycontext_test>
    <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="device_t in /dev" id="oval:ssg-test_selinux_confinement_of_daemons:tst:1" version="2">
      <linux:object object_ref="oval:ssg-object_selinux_confinement_of_daemons:obj:1"/>
      <linux:state state_ref="oval:ssg-state_selinux_confinement_of_daemons:ste:1"/>
    </linux:selinuxsecuritycontext_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in the /etc/selinux/config file" id="oval:ssg-test_selinux_policy:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_selinux_policy:obj:1"/>
      <ind:state state_ref="oval:ssg-state_selinux_policy:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/selinux/enforce is 1" id="oval:ssg-test_etc_selinux_config:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_selinux_config:obj:1"/>
      <ind:state state_ref="oval:ssg-state_etc_selinux_config:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check /etc/firewalld/firewalld.conf DefaultZone for drop" id="oval:ssg-test_firewalld_input_drop:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_firewalld_input_drop:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="The password hashing algorithm should be set correctly in /etc/libuser.conf" id="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-test_etc_login_defs_encrypt_method:tst:1" check="all" comment="The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs" version="1">
      <ind:object object_ref="oval:ssg-object_last_encrypt_method_instance_value:obj:1"/>
      <ind:state state_ref="oval:ssg-state_last_encrypt_method_instance_value:ste:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/system-auth for correct settings" id="oval:ssg-test_pam_unix_sha512:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_pam_unix_sha512:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_default_communities:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_snmp_default_communities:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_versions:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_snmp_versions:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="sshd uses protocol 2" id="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_sshd_allow_only_protocol2:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the PermitEmptyPasswords[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_permitemptypasswords_no:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_permitemptypasswords_no:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the IgnoreRhosts[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_rsh_emulation_disabled:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_rsh_emulation_disabled:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the RhostsRSAAuthentication[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the PermitRootLogin[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_permitrootlogin_no:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_permitrootlogin_no:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the IgnoreUserKnownHosts[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check value of PermitUserEnvironment in /etc/ssh/sshd_config" id="oval:ssg-test_sshd_no_user_envset:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_no_user_envset:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the Banner[\s]+/etc/issue setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_banner_set:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_banner_set:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="timeout is configured" id="oval:ssg-test_sshd_idle_timeout:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_sshd_idle_timeout:obj:1"/>
      <ind:state state_ref="oval:ssg-state_timeout_value_upper_bound:ste:1"/>
      <ind:state state_ref="oval:ssg-state_timeout_value_lower_bound:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_clientalivecountmax:obj:1"/>
      <ind:state state_ref="oval:ssg-state_sshd_clientalivecountmax:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Ciphers setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_use_approved_ciphers:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_use_approved_ciphers:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of MACs setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_use_approved_macs:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sshd_use_approved_macs:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*BOOTPROTO[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/network-scripts/ifcfg-.* file" id="oval:ssg-test_sysconfig_networking_bootproto_ifcfg:tst:1" version="1">
      <ind:object object_ref="oval:ssg-obj_sysconfig_networking_bootproto_ifcfg:obj:1"/>
      <ind:state state_ref="oval:ssg-state_sysconfig_networking_bootproto_ifcfg:ste:1"/>
    </ind:textfilecontent54_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.exec-shield set to 1" id="oval:ssg-test_runtime_sysctl_kernel_exec_shield:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_exec_shield:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_exec_shield:ste:1"/>
    </unix:sysctl_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.exec-shield static configuration" id="oval:ssg-test_static_sysctl_kernel_exec_shield:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_exec_shield:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NX is disabled" id="oval:ssg-test_nx_disabled_grub:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_nx_disabled_grub:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:sysctl_test id="oval:ssg-test_runtime_kernel_dmesg_restrict:tst:1" check="all" check_existence="all_exist" comment="Check kernel.dmesg_restrict kernel runtime parameter" version="1">
      <unix:object object_ref="oval:ssg-object_runtime_kernel_dmesg_restrict:obj:1"/>
      <unix:state state_ref="oval:ssg-state_runtime_kernel_dmesg_restrict:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.randomize_va_space set to 2" id="oval:ssg-test_runtime_sysctl_kernel_randomize_va_space:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_kernel_randomize_va_space:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_kernel_randomize_va_space:ste:1"/>
    </unix:sysctl_test>
    <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" id="oval:ssg-test_runtime_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1"/>
      <unix:state state_ref="oval:ssg-state_sysctl_net_ipv6_conf_all_disable_ipv6:ste:1"/>
    </unix:sysctl_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_kernel_dmesg_restrict:tst:1" check="all" check_existence="only_one_exists" comment="Check kernel.dmesg_restrict static configuration in /etc/sysctl.d/*" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctld_kernel_dmesg_restrict:obj:1"/>
      <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_etc_sysctl_kernel_dmesg_restrict:tst:1" check="all" comment="Check kernel.dmesg_restrict static configuration in /etc/sysctl.conf" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctl_kernel_dmesg_restrict:obj:1"/>
      <!-- Re-use the above defined state (since the requirement is same for both locations) -->
      <ind:state state_ref="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test id="oval:ssg-test_static_sysctld_kernel_dmesg_restrict_not_used:tst:1" check="all" check_existence="none_exist" comment="Check kernel.dmesg_restrict is not used in some file from /etc/sysctl.d/* location" version="1">
      <!-- Re-use the above defined object_static_sysctld_kernel_dmesg_restrict object. We require object of same properties,
         but this time we require no such object to exist in /etc/sysctl.d/* -->
      <ind:object object_ref="oval:ssg-object_static_sysctld_kernel_dmesg_restrict:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.randomize_va_space static configuration" id="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.disable_ipv6 static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
    </ind:textfilecontent54_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_ppc_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_ppc_64:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="32 bit architecture" id="oval:ssg-test_system_info_architecture_x86:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_x86:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_x86:ste:1"/>
    </unix:uname_test>
    <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_system_info_architecture_x86_64:obj:1"/>
      <unix:state state_ref="oval:ssg-state_system_info_architecture_x86_64:ste:1"/>
    </unix:uname_test>
    <ind:textfilecontent54_test check="all" comment="tftpd secure mode" id="oval:ssg-test_tftpd_uses_secure_mode:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_tftpd_uses_secure_mode:obj:1"/>
    </ind:textfilecontent54_test>
    <ind:variable_test id="oval:ssg-tst_umask_for_daemons:tst:1" version="1" check="all" comment="Test the retrieved /etc/init.d/functions umask value(s) match the var_umask_for_daemons requirement">
      <ind:object object_ref="oval:ssg-obj_umask_for_daemons:obj:1"/>
      <ind:state state_ref="oval:ssg-ste_umask_for_daemons:ste:1"/>
    </ind:variable_test>
    <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /etc/shadow" id="oval:ssg-test_userowner_shadow_file:tst:1" version="1">
      <unix:object object_ref="oval:ssg-object_file_etc_shadow:obj:1"/>
      <unix:state state_ref="oval:ssg-state_etc_shadow_uid_root:ste:1"/>
    </unix:file_test>
    <ind:variable_test id="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1" comment="Verify the existence of var_accounts_user_umask_as_number variable" check="all" check_existence="at_least_one_exists" version="1">
      <ind:object object_ref="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" check="all" comment="Check if removable partition variable value represents CD/DVD drive" version="1">
      <ind:object object_ref="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1"/>
      <ind:state state_ref="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1"/>
    </ind:variable_test>
    <ind:variable_test id="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1" comment="Verify the existence of var_umask_for_daemons_as_number variable" check="all" check_existence="at_least_one_exists" version="1">
      <ind:object object_ref="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1"/>
    </ind:variable_test>
    <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="query /proc/net/wireless" id="oval:ssg-test_wireless_disable_interfaces:tst:1" version="1">
      <ind:object object_ref="oval:ssg-object_wireless_disable_interfaces:obj:1"/>
    </ind:textfilecontent54_test>
  </tests>
  <objects>
    <ind:textfilecontent54_object id="oval:ssg-obj_docker_selinux_enabled:obj:1" version="2">
      <ind:filepath operation="equals">/etc/sysconfig/docker</ind:filepath>
      <ind:pattern operation="pattern match">^(?!#)\s*OPTIONS\s*=.*[\s'](--selinux-enabled)[\s'].*$</ind:pattern>
      <ind:instance operation="equals" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_storage_device_path:obj:1" version="1">
      <ind:filepath operation="equals" var_ref="oval:ssg-var_configuration_files_storage:var:1" var_check="at least one"/>
      <ind:pattern operation="pattern match">^(?!#).*(?:--storage-opt[\s=]dm\.thinpooldev=([^\s]*)).*$</ind:pattern>
      <ind:instance operation="equals" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_docker_storage_driver:obj:1" version="1">
      <ind:filepath operation="equals" var_ref="oval:ssg-var_configuration_files_storage:var:1" var_check="at least one"/>
      <ind:pattern operation="pattern match">^(?!#)\s*STORAGE_DRIVER\s*=\s*"?([a-z]*)"?\s*$</ind:pattern>
      <ind:instance operation="equals" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-obj_storage_device:obj:1" version="1" comment="Thinpool device">
      <unix:filepath operation="equals" var_ref="oval:ssg-var_storage_device:var:1" var_check="at least one"/>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_abrt_removed:obj:1" version="1">
      <linux:name>abrt</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_acpid_removed:obj:1" version="1">
      <linux:name>acpid</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_at_removed:obj:1" version="1">
      <linux:name>at</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_autofs_removed:obj:1" version="1">
      <linux:name>autofs</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_avahi_removed:obj:1" version="1">
      <linux:name>avahi</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_bind_removed:obj:1" version="1">
      <linux:name>bind</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_bluez_removed:obj:1" version="1">
      <linux:name>bluez</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_certmonger_removed:obj:1" version="1">
      <linux:name>certmonger</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_cups_removed:obj:1" version="1">
      <linux:name>cups</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_cyrus-sasl_removed:obj:1" version="1">
      <linux:name>cyrus-sasl</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_dbus_removed:obj:1" version="1">
      <linux:name>dbus</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_dhcp_removed:obj:1" version="1">
      <linux:name>dhcp</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_docker_installed:obj:1" version="1">
      <linux:name>docker</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_dovecot_removed:obj:1" version="1">
      <linux:name>dovecot</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_esc_installed:obj:1" version="1">
      <linux:name>esc</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_httpd_removed:obj:1" version="1">
      <linux:name>httpd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_iputils_removed:obj:1" version="1">
      <linux:name>iputils</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_irqbalance_installed:obj:1" version="1">
      <linux:name>irqbalance</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_kernel-tools_removed:obj:1" version="1">
      <linux:name>kernel-tools</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_kexec-tools_removed:obj:1" version="1">
      <linux:name>kexec-tools</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_libcgroup-tools_removed:obj:1" version="1">
      <linux:name>libcgroup-tools</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_libcgroup_removed:obj:1" version="1">
      <linux:name>libcgroup</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_mdadm_removed:obj:1" version="1">
      <linux:name>mdadm</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_net-snmp_removed:obj:1" version="1">
      <linux:name>net-snmp</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_nfs-utils_removed:obj:1" version="1">
      <linux:name>nfs-utils</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_ntp_installed:obj:1" version="1">
      <linux:name>ntp</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_ntpdate_removed:obj:1" version="1">
      <linux:name>ntpdate</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_oddjob_removed:obj:1" version="1">
      <linux:name>oddjob</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_openssh-server_installed:obj:1" version="1">
      <linux:name>openssh-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_openssh-server_removed:obj:1" version="1">
      <linux:name>openssh-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_pam_pkcs11_installed:obj:1" version="1">
      <linux:name>pam_pkcs11</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_pcsc-lite_installed:obj:1" version="1">
      <linux:name>pcsc-lite</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_portreserve_removed:obj:1" version="1">
      <linux:name>portreserve</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_postfix_installed:obj:1" version="1">
      <linux:name>postfix</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_psacct_installed:obj:1" version="1">
      <linux:name>psacct</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_qpid-cpp-server_removed:obj:1" version="1">
      <linux:name>qpid-cpp-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_quagga_removed:obj:1" version="1">
      <linux:name>quagga</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_quota-nld_removed:obj:1" version="1">
      <linux:name>quota-nld</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_rhnsd_removed:obj:1" version="1">
      <linux:name>rhnsd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_samba_removed:obj:1" version="1">
      <linux:name>samba</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_smartmontools_removed:obj:1" version="1">
      <linux:name>smartmontools</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_squid_removed:obj:1" version="1">
      <linux:name>squid</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_sssd_installed:obj:1" version="1">
      <linux:name>sssd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_sssd_removed:obj:1" version="1">
      <linux:name>sssd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_subscription-manager_removed:obj:1" version="1">
      <linux:name>subscription-manager</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_sysstat_removed:obj:1" version="1">
      <linux:name>sysstat</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_tcp_wrappers_installed:obj:1" version="1">
      <linux:name>tcp_wrappers</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_tftp-server_removed:obj:1" version="1">
      <linux:name>tftp-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_vsftpd_removed:obj:1" version="1">
      <linux:name>vsftpd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_xinetd_installed:obj:1" version="1">
      <linux:name>xinetd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_xinetd_removed:obj:1" version="1">
      <linux:name>xinetd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_ypbind_removed:obj:1" version="1">
      <linux:name>ypbind</linux:name>
    </linux:rpminfo_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_pcscd.socket:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_abrtd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_acpid:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_atd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_autofs:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_avahi-daemon:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_bluetooth:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_certmonger:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cgconfig:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cgred:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_chronyd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cpupower:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_crond:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cups:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_debug-shell:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_dhcpd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_docker:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_dovecot:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_firewalld:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_httpd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_irqbalance:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_kdump:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_mdmonitor:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_messagebus:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_named:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_netconsole:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_nfs:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_nfslock:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpdate:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_oddjobd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_portreserve:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_postfix:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_psacct:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_qpidd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_quota_nld:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rdisc:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_xinetd_rexec_disabled:obj:1" version="1">
      <ind:filepath>/etc/xinetd.d/rexec</ind:filepath>
      <ind:pattern operation="pattern match">^\s*disable\s+=\s+yes\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rexec:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rhnsd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rhsmcertd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_xinetd_rlogin_disabled:obj:1" version="1">
      <ind:filepath>/etc/xinetd.d/rlogin</ind:filepath>
      <ind:pattern operation="pattern match">^\s*disable\s+=\s+yes\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rlogin:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rpcbind:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rpcgssd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rpcidmapd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rpcsvcgssd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_xinetd_rsh_disabled:obj:1" version="1">
      <ind:filepath>/etc/xinetd.d/rsh</ind:filepath>
      <ind:pattern operation="pattern match">^\s*disable\s+=\s+yes\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsh:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_saslauthd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_smartd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_smb:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_snmpd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_squid:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_sshd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_sssd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_sysstat:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <ind:textfilecontent54_object comment="Disable Telnet Service" id="oval:ssg-obj_xinetd_telnetd_disabled:obj:1" version="1">
      <ind:filepath>/etc/xinetd.d/telnet</ind:filepath>
      <ind:pattern operation="pattern match">^\s*disable\s+=\s+no\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_telnet:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_tftp:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_vsftpd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_xinetd:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ypbind:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_zebra:obj:1" comment="list of dependencies of multi-user.target" version="1">
      <linux:unit>multi-user.target</linux:unit>
    </linux:systemdunitdependency_object>
    <ind:textfilecontent54_object id="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1" version="1">
      <ind:filepath>/etc/pam_pkcs11/pam_pkcs11.conf</ind:filepath>
      <!-- PKCS #11 module can be either CoolKey or OpenSC. Check cert_policy for all of them. -->
      <ind:pattern operation="pattern match">^[\s]*cert_policy[ ]=(.*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_smart_card_enabled_system_auth:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_enabled_system_auth:var:1" var_check="at least one"/>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_smart_card_required_system_auth:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_required_system_auth:var:1" var_check="at least one"/>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_smart_card_required_smartcard_auth:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/smartcard-auth</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" var_check="at least one"/>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="/etc/sssd/sssd.conf" id="oval:ssg-object_sssd_conf_exists:obj:1" version="1">
      <unix:filepath>/etc/sssd/sssd.conf</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sssd_memcache_timeout:obj:1" version="1">
      <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\[nss]([^\n]*\n+)+?memcache_timeout[\s]+=[\s]+86400$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sssd_offline_cred_expiration:obj:1" version="1">
      <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\[pam]([^\n]*\n+)+?offline_credentials_expiration[\s]+=[\s]+1$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sssd_ssh_known_hosts_timeout:obj:1" version="1">
      <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\[ssh]([^\n]*\n+)+?ssh_known_hosts_timeout[\s]+=[\s]+86400$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Ensure more than one chronyd NTP server is set" id="oval:ssg-object_chronyd_multiple_servers:obj:1" version="1">
      <ind:filepath>/etc/chrony.conf</ind:filepath>
      <ind:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Ensure at least one NTP server is set" id="oval:ssg-object_chronyd_remote_server:obj:1" version="1">
      <ind:filepath>/etc/chrony.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*server[\s]+.+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:symlink_object comment="Disable Ctrl-Alt-Del key sequence override exists" id="oval:ssg-object_disable_ctrlaltdel_exists:obj:1" version="1">
      <unix:filepath>/etc/systemd/system/ctrl-alt-del.target</unix:filepath>
    </unix:symlink_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dovecot_disable_plaintext_auth:obj:1" version="1">
      <ind:filepath>/etc/dovecot/conf.d/10-auth.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*disable_plaintext_auth[\s]*=[\s]*yes[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dovecot_enable_ssl:obj:1" version="1">
      <ind:filepath>/etc/dovecot/conf.d/10-ssl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*ssl[\s]*=[\s]*(yes|required)[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Ensure more than one ntpd NTP server is set" id="oval:ssg-obj_ntpd_multiple_servers:obj:1" version="1">
      <ind:filepath>/etc/ntp.conf</ind:filepath>
      <ind:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Ensure at least one ntpd NTP server is set" id="oval:ssg-obj_ntp_remote_server:obj:1" version="1">
      <ind:filepath>/etc/ntp.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*server[\s]+.+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_audit_installed:obj:1" version="1">
      <linux:name>audit</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_chrony_installed:obj:1" version="1">
      <linux:name>chrony</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_cronie_installed:obj:1" version="1">
      <linux:name>cronie</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_firewalld_installed:obj:1" version="1">
      <linux:name>firewalld</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_postfix_network_listening_disabled:obj:1" comment="inet_interfaces in /etc/postfix/main.cf should be set correctly" version="1">
      <ind:filepath>/etc/postfix/main.cf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*inet_interfaces[\s]*=[\s]*localhost[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfg_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfg_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_groupownership:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfg_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfo_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfo_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_ownership:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfo_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive value" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\$IncludeConfig[\s]+([^\s;]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rfp_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
      <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfp_all_log_files_as_collection:var:1" var_check="at least one"/>
      <!-- Chunk of text retrieved from rsyslog's configuration file is considered
         to constitute a log file path if all of the following conditions are met:
         * the string represents a regular file on particular file system
           (verified via corresponding file_state below),
         * the chunk of text is in the last column in the row,
           (possibly suffixed by ';' character and rsyslog Template name),
         * contains at least one slash '/' character, and simultaneously
           doesn't contain any of ';', ':' and space characters,
         * the chunk was retrieved from a row not starting with space, '#',
           or '$' characters
    -->
      <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_rsyslog_files_permissions:obj:1" comment="Various system log files" version="1">
      <unix:filepath datatype="string" var_ref="oval:ssg-var_rfp_log_files_paths:var:1" var_check="at least one"/>
    </unix:file_object>
    <unix:symlink_object comment="default.target systemd softlink exists" id="oval:ssg-object_disable_xwindows_runlevel:obj:1" version="1">
      <unix:filepath>/etc/systemd/system/default.target</unix:filepath>
    </unix:symlink_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_logon_fail_delay:obj:1" comment="FAIL_DELAY value from /etc/login.defs" version="1">
      <ind:filepath>/etc/login.defs</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)FAIL_DELAY(?-i)[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_pam_faillock_preauth_silent_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
         pam_unix.so module in auth section -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_pam_faillock_authfail_deny_root_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*even_deny_root[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_pam_faillock_preauth_silent_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/password-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
         pam_unix.so module in auth section -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_pam_faillock_authfail_deny_root_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*even_deny_root[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_yum_clean_components_post_updating:obj:1" comment="clean_requirements_on_remove set in /etc/yum.conf" version="1">
      <ind:filepath>/etc/yum.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*clean_requirements_on_remove\s*=\s*(1|True|yes)\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1" version="1">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)X11Forwarding(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1" comment="localpkg_gpgcheck set in /etc/yum.conf" version="1">
      <ind:filepath>/etc/yum.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*localpkg_gpgcheck\s*=\s*(1|True|yes)\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_repo_metadata:obj:1" comment="repo_gpgcheck set in /etc/yum.conf" version="1">
      <ind:filepath>/etc/yum.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*repo_gpgcheck\s*=\s*(1|True|yes)\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="/etc/cron.allow" id="oval:ssg-object_groupowner_cron_allow_file:obj:1" version="1">
      <unix:filepath>/etc/cron.allow</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/cron.allow" id="oval:ssg-object_file_etc_cron_allow:obj:1" version="1">
      <unix:filepath>/etc/cron.allow</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/ssh" id="oval:ssg-object_file_permissions_sshd_private_key:obj:1" version="1">
      <unix:path>/etc/ssh/</unix:path>
      <unix:filename operation="pattern match">^.*key$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="/etc/ssh" id="oval:ssg-object_file_permissions_sshd_pub_key:obj:1" version="1">
      <unix:path>/etc/ssh/</unix:path>
      <unix:filename operation="pattern match">^.*key.pub$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="files with sgid set" id="oval:ssg-object_file_permissions_unauthorized_sgid:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid:ste:1</filter>
      <filter action="exclude">oval:ssg-state_sgid_whitelist:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="files with suid set" id="oval:ssg-object_file_permissions_unauthorized_suid:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_file_permissions_unauthorized_suid:ste:1</filter>
      <filter action="exclude">oval:ssg-state_suid_whitelist:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_grub2_enable_fips_mode:obj:1" version="1">
      <ind:filepath>/etc/default/grub</ind:filepath>
      <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_grub2_enable_fips_mode_default:obj:1" version="1">
      <ind:filepath>/etc/default/grub</ind:filepath>
      <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_grub2_default_exists:obj:1" version="1">
      <ind:filepath>/etc/default/grub</ind:filepath>
      <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_kernel-PAE_installed:obj:1" version="1">
      <linux:name>kernel-PAE</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1" version="1" comment="kernel module bluetooth disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of bluetooth">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_etcmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /etc/modules-load.d">
      <ind:path>/etc/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_runmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /run/modules-load.d">
      <ind:path>/run/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_libmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d">
      <ind:path>/usr/lib/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_disabled:obj:1" version="1" comment="kernel module cramfs disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of cramfs">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_etcmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /etc/modules-load.d">
      <ind:path>/etc/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_runmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /run/modules-load.d">
      <ind:path>/run/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_libmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /usr/lib/modules-load.d">
      <ind:path>/usr/lib/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1" version="1" comment="kernel module freevxfs disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of freevxfs">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_etcmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /etc/modules-load.d">
      <ind:path>/etc/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_runmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /run/modules-load.d">
      <ind:path>/run/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_libmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d">
      <ind:path>/usr/lib/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_disabled:obj:1" version="1" comment="kernel module hfs disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of hfs">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_etcmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /etc/modules-load.d">
      <ind:path>/etc/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_runmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /run/modules-load.d">
      <ind:path>/run/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_libmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /usr/lib/modules-load.d">
      <ind:path>/usr/lib/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1" version="1" comment="kernel module hfsplus disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of hfsplus">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_etcmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /etc/modules-load.d">
      <ind:path>/etc/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_runmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /run/modules-load.d">
      <ind:path>/run/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_libmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d">
      <ind:path>/usr/lib/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_disabled:obj:1" version="1" comment="kernel module jffs2 disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of jffs2">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_etcmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /etc/modules-load.d">
      <ind:path>/etc/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_runmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /run/modules-load.d">
      <ind:path>/run/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_libmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d">
      <ind:path>/usr/lib/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_sctp_disabled:obj:1" version="1" comment="kernel module sctp disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+sctp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_sctp_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of sctp">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+sctp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_sctp_etcmodules-load:obj:1" version="1" comment="kernel module sctp disabled in /etc/modules-load.d">
      <ind:path>/etc/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+sctp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_sctp_runmodules-load:obj:1" version="1" comment="kernel module sctp disabled in /run/modules-load.d">
      <ind:path>/run/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+sctp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_sctp_libmodules-load:obj:1" version="1" comment="kernel module sctp disabled in /usr/lib/modules-load.d">
      <ind:path>/usr/lib/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+sctp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_disabled:obj:1" version="1" comment="kernel module squashfs disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of squashfs">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_etcmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /etc/modules-load.d">
      <ind:path>/etc/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_runmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /run/modules-load.d">
      <ind:path>/run/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_libmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /usr/lib/modules-load.d">
      <ind:path>/usr/lib/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_disabled:obj:1" version="1" comment="kernel module udf disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of udf">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_etcmodules-load:obj:1" version="1" comment="kernel module udf disabled in /etc/modules-load.d">
      <ind:path>/etc/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_runmodules-load:obj:1" version="1" comment="kernel module udf disabled in /run/modules-load.d">
      <ind:path>/run/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_libmodules-load:obj:1" version="1" comment="kernel module udf disabled in /usr/lib/modules-load.d">
      <ind:path>/usr/lib/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nfs_krb_sec_etc_fstab:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^\s*\[?[\.\w-:]+\]?:[/\w-]+\s+[/\w-]+\s+nfs[4]?\s+(.*)$</ind:pattern>
      <!-- the "not equal" operation essentially means all instances of the regexp -->
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_no_nfs_defined_etc_fstab_krb_sec:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^\s*\[?[\.\w-:]+\]?:[/\w-]+\s+[/\w-]+\s+nfs[4]?\s+.*$</ind:pattern>
      <!-- the "not equal" operation below essentially means all instances of the regexp -->
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_network_disable_ddns_interfaces_ifcfg:obj:1" version="1">
      <ind:path>/etc/sysconfig/network-scripts</ind:path>
      <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*DHCP_HOSTNAME[\s]*=.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_network_disable_ddns_interfaces_dhclient:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/dhclient.*\.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*send[\s]+host-name.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_network_disable_ddns_interfaces_dhcp:obj:1" version="1">
      <ind:path>/etc/dhcp</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*send[\s]+host-name.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_aide_installed:obj:1" version="1">
      <linux:name>aide</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_dconf_installed:obj:1" version="1">
      <linux:name>dconf</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_vsftpd_installed:obj:1" version="1">
      <linux:name>vsftpd</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog:obj:1" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*cron\.\*[\s]*/var/log/cron$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1" version="1">
      <ind:path>/etc/rsyslog.d</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*cron\.\*[\s]*/var/log/cron$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel0_nails:obj:1" version="1">
      <unix:service_name>nails</unix:service_name>
      <unix:runlevel operation="equals">0</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel1_nails:obj:1" version="1">
      <unix:service_name>nails</unix:service_name>
      <unix:runlevel operation="equals">1</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel2_nails:obj:1" version="1">
      <unix:service_name>nails</unix:service_name>
      <unix:runlevel operation="equals">2</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel3_nails:obj:1" version="1">
      <unix:service_name>nails</unix:service_name>
      <unix:runlevel operation="equals">3</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel4_nails:obj:1" version="1">
      <unix:service_name>nails</unix:service_name>
      <unix:runlevel operation="equals">4</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel5_nails:obj:1" version="1">
      <unix:service_name>nails</unix:service_name>
      <unix:runlevel operation="equals">5</unix:runlevel>
    </unix:runlevel_object>
    <unix:runlevel_object id="oval:ssg-obj_runlevel6_nails:obj:1" version="1">
      <unix:service_name>nails</unix:service_name>
      <unix:runlevel operation="equals">6</unix:runlevel>
    </unix:runlevel_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_compression:obj:1" version="1">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)Compression(?-i)[\s]+(no|delayed)[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1" version="1">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)GSSAPIAuthentication(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth:obj:1" version="1">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)KerberosAuthentication(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes:obj:1" version="1">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)StrictModes(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_printlastlog:obj:1" version="1">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)PrintLastLog(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_priv_separation:obj:1" version="1">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)UsePrivilegeSeparation(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers:obj:1" version="1">
      <ind:filepath>/etc/sudoers</ind:filepath>
      <ind:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1" version="1">
      <ind:path>/etc/sudoers.d</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers:obj:1" version="1">
      <ind:filepath>/etc/sudoers</ind:filepath>
      <ind:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1" version="1">
      <ind:path>/etc/sudoers.d</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_fs_suid_dumpable:obj:1" version="1">
      <unix:name>fs.suid_dumpable</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.accept_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.accept_source_route</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.log_martians</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.rp_filter</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.secure_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.all.send_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.default.accept_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
      <unix:name>net.ipv4.conf.default.accept_source_route</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
      <unix:name>net.ipv4.conf.default.log_martians</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
      <unix:name>net.ipv4.conf.default.rp_filter</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.default.secure_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
      <unix:name>net.ipv4.conf.default.send_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
      <unix:name>net.ipv4.icmp_echo_ignore_broadcasts</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
      <unix:name>net.ipv4.icmp_ignore_bogus_error_responses</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_ip_forward:obj:1" version="1">
      <unix:name>net.ipv4.ip_forward</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
      <unix:name>net.ipv4.tcp_syncookies</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
      <unix:name>net.ipv6.conf.all.accept_ra</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
      <unix:name>net.ipv6.conf.all.accept_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
      <unix:name>net.ipv6.conf.all.accept_source_route</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
      <unix:name>net.ipv6.conf.all.forwarding</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
      <unix:name>net.ipv6.conf.default.accept_ra</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
      <unix:name>net.ipv6.conf.default.accept_redirects</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
      <unix:name>net.ipv6.conf.default.accept_source_route</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_redirects:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_source_route:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_forwarding:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_forwarding:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_forwarding:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_forwarding:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_source_route:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_use_kerberos_security_all_exports:obj:1" version="2">
      <ind:filepath>/etc/exports</ind:filepath>
      <ind:pattern operation="pattern match">^\/.*\((\S+)\)$</ind:pattern>
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_non_empty_exports_file:obj:1" version="1">
      <ind:filepath>/etc/exports</ind:filepath>
      <ind:pattern operation="pattern match">^\/.*$</ind:pattern>
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_default_useradd_inactive:obj:1" version="1">
      <ind:filepath>/etc/default/useradd</ind:filepath>
      <ind:pattern operation="pattern match">^\s*INACTIVE\s*=\s*(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_content:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <!-- User names from /etc/passwd (1-th column) captured as subexpression of this object -->
      <ind:pattern operation="pattern match">^([^:]+):.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1" version="1">
      <ind:filepath>/etc/security/limits.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1" version="1">
      <ind:path>/etc/security/limits.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1" version="1">
      <ind:path>/etc/security/limits.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MAX_DAYS directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MAX_DAYS directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_max_days_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_max_days_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MIN_DAYS directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MIN_DAYS directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_DAYS\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_min_days_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_min_days_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_no_uid_except_root:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <ind:pattern operation="pattern match">^(?!root:)[^:]*:[^:]*:0</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:password_object id="oval:ssg-object_accounts_password_all_shadowed:obj:1" version="1">
      <unix:username operation="pattern match">.*</unix:username>
    </unix:password_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MIN_LEN directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_MIN_LEN directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_LEN\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_min_len_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_min_len_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1" version="1">
      <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
      <ind:pattern operation="pattern match">^dcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_difok:obj:1" version="1">
      <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
      <ind:pattern operation="pattern match">^difok[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1" version="1">
      <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
      <ind:pattern operation="pattern match">^lcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1" version="1">
      <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
      <ind:pattern operation="pattern match">^maxclassrepeat[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1" version="1">
      <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
      <ind:pattern operation="pattern match">^maxrepeat[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minclass:obj:1" version="1">
      <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
      <ind:pattern operation="pattern match">^minclass[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minlen:obj:1" version="1">
      <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
      <ind:pattern operation="pattern match">^minlen[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1" version="1">
      <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
      <ind:pattern operation="pattern match">^ocredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_cracklib_retry:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*retry=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_retry:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1" version="1">
      <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
      <ind:pattern operation="pattern match">^ucredit[s\]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
      <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_unix_remember:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*remember=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so.*remember=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_WARN_AGE directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of PASS_WARN_AGE directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(PASS_WARN_AGE\s+\d+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_pass_warn_age_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_pass_warn_age_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
         pam_unix.so module in auth section -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in account section is listed right before pam_unix.so account row -->
      <ind:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/password-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so preauth silent in auth section is listed before
         pam_unix.so module in auth section -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in auth section is listed right after pam_unix.so auth row -->
      <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]+(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1" version="1">
      <!-- Read whole /etc/pam.d/system-auth content as single line so we can verify existing order of PAM modules -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <!-- Since order of PAM modules matters ensure pam_faillock.so in account section is listed right before pam_unix.so account row -->
      <ind:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
      <!-- Check only the first instance -->
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*fail_interval=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*fail_interval=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*fail_interval=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*fail_interval=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*unlock_time=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*unlock_time=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*unlock_time=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:obj:1" version="2">
      <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
      <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*unlock_time=([0-9]*).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:environmentvariable58_object id="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1" version="1">
      <ind:pid xsi:nil="true" datatype="int"/>
      <ind:name>PATH</ind:name>
    </ind:environmentvariable58_object>
    <unix:file_object comment="root's path directories with wrong group / other write permissions" id="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1" version="1">
      <unix:path var_ref="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" var_check="at least one"/>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1</filter>
      <filter action="exclude">oval:ssg-state_accounts_root_path_dirs_symlink:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_profile_tmout:obj:1" version="1">
      <ind:filepath>/etc/profile</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*TMOUT[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_profiled_tmout:obj:1" version="1">
      <ind:path>/etc/profile.d</ind:path>
      <ind:filename operation="pattern match">^.*\.sh$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*TMOUT[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_bashrc:obj:1" comment="Umask value from /etc/bashrc" version="1">
      <ind:filepath>/etc/bashrc</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_bashrc:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_etc_bashrc_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1" comment="Umask value from /etc/csh.cshrc" version="1">
      <ind:filepath>/etc/csh.cshrc</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_csh_cshrc:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_etc_csh_cshrc_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_login_defs:obj:1" comment="Umask value from /etc/login.defs" version="1">
      <ind:filepath>/etc/login.defs</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_etc_login_defs_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_profile:obj:1" comment="Umask value from /etc/profile" version="1">
      <ind:filepath>/etc/profile</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_profile:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_etc_profile_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_build_database_dirpath:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^@@define[\s]DBDIR[\s]+(/.*)$</ind:pattern>
      <ind:instance operation="equals" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_build_new_database_filename:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^database_out=file:@@{DBDIR}/([a-z.]+)$</ind:pattern>
      <!-- From aide.conf(5) - "If there are multiple database_out lines, then the first one is used" =>
         therefore we will retrieve only the first instance -->
      <ind:instance operation="equals" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_operational_database_filename:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^database=file:@@{DBDIR}/([a-z.]+)$</ind:pattern>
      <!-- From aide.conf(5) - "If there are multiple database_out lines, then the first one is used" =>
                  therefore we will retrieve only the first instance -->
      <ind:instance operation="equals" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_aide_build_new_database_absolute_path:obj:1" version="1">
      <unix:filepath var_ref="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" var_check="at least one"/>
    </unix:file_object>
    <unix:file_object id="oval:ssg-object_aide_operational_database_absolute_path:obj:1" version="1">
      <unix:filepath var_ref="oval:ssg-variable_aide_operational_database_absolute_path:var:1" var_check="at least one"/>
    </unix:file_object>
    <ind:textfilecontent54_object comment="run aide daily with cron" id="oval:ssg-object_test_aide_periodic_cron_checking:obj:1" version="1">
      <ind:filepath>/etc/crontab</ind:filepath>
      <ind:pattern operation="pattern match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="run aide daily with cron" id="oval:ssg-object_test_aide_crond_checking:obj:1" version="1">
      <ind:path>/etc/cron.d</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*root[\s]*/usr/sbin/aide[\s]*\-\-check.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="run aide daily with cron" id="oval:ssg-object_aide_var_cron_checking:obj:1" version="1">
      <ind:filepath>/var/spool/cron/root</ind:filepath>
      <ind:pattern operation="pattern match">^[0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*\*[\s]*(root|)/usr/sbin/aide[\s]*\-\-check.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="run aide daily with cron.(daily|weekly|monthly)" id="oval:ssg-object_aide_crontabs_checking:obj:1" version="1">
      <ind:path operation="pattern match">/etc/cron.(daily|weekly|monthly)</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\s*/usr/sbin/aide[\s]*\-\-check.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="notify personnel when aide completes" id="oval:ssg-object_test_aide_scan_notification:obj:1" version="1">
      <ind:filepath>/etc/crontab</ind:filepath>
      <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*root@.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="notify personnel when aide completes" id="oval:ssg-object_aide_var_cron_notification:obj:1" version="1">
      <ind:filepath>/var/spool/cron/root</ind:filepath>
      <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*root@.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="notify personnel when aide completes in cron.(d|daily|weekly|monthly)" id="oval:ssg-object_aide_crontabs_notification:obj:1" version="1">
      <ind:path operation="pattern match">/etc/cron.(d|daily|weekly|monthly)</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^.*/usr/sbin/aide[\s]*\-\-check.*\|.*/bin/mail[\s]*-s[\s]*".*"[\s]*root@.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_non_fips_hashes:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[A-Z]*[\s]*=[\s]*.*(sha1|rmd160|sha256|whirlpool|tiger|haval|gost|crc32).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_use_fips_hashes:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[A-Z]*[\s]*=[\s]*([a-z0-9\+]*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_acls:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^(?!ALLXTRAHASHES)[A-Z]*[\s]*=[\s]*([a-z0-9\+]*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_ext_attributes:obj:1" version="1">
      <ind:filepath>/etc/aide.conf</ind:filepath>
      <ind:pattern operation="pattern match">^(?!ALLXTRAHASHES)[A-Z]*[\s]*=[\s]*([a-z0-9\+]*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_chmod_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_chmod_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chmod[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_chown_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_chown_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+chown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fchmod_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fchmod_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchmod[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fchmodat_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fchmodat_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchmodat[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fchown_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fchown_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fchownat_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fchownat_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fchownat[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fremovexattr_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fremovexattr_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fremovexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fsetxattr_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_fsetxattr_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+fsetxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_lchown_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_lchown_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lchown[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_lremovexattr_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_lremovexattr_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lremovexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_lsetxattr_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_lsetxattr_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+lsetxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_removexattr_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_removexattr_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+removexattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_setxattr_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ardm_setxattr_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*-S[\s]+setxattr[\s]+)(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=4294967295[\s]+).*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_file_deletion_events_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_file_deletion_events_file_delete_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+rmdir\s+\-S\s+unlink\s+\-S\s+unlinkat\s+\-S\s+rename\s+\-S\s+renameat\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_file_deletion_events_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_file_deletion_events_file_delete_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+rmdir\s+\-S\s+unlink\s+\-S\s+unlinkat\s+\-S\s+rename\s+\-S\s+renameat\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ari_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ari_locked_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-e\s+2\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ari_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_ari_locked_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-e\s+2\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_insmod_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/usr/sbin/insmod[\s]+\-p[\s]+\b([raw]*x[raw]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_rmmod_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/usr/sbin/rmmod[\s]+\-p[\s]+\b([raw]*x[raw]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_modprobe_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/usr/sbin/modprobe[\s]+\-p[\s]+\b([raw]*x[raw]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_syscall_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+init_module\s+\-S\s+delete_module\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_insmod_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/usr/sbin/insmod[\s]+\-p[\s]+\b([raw]*x[raw]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_rmmod_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/usr/sbin/rmmod[\s]+\-p[\s]+\b([raw]*x[raw]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_modprobe_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/usr/sbin/modprobe[\s]+\-p[\s]+\b([raw]*x[raw]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rule_kernel_module_loading_syscall_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+init_module\s+\-S\s+delete_module\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arle_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arle_tallylog_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/tallylog\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arle_faillock_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/run/faillock/\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arle_lastlog_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/lastlog\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arle_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arle_tallylog_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/tallylog\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arle_faillock_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/run/faillock/\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arle_lastlog_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/lastlog\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_armm_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_armm_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_media_export_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_media_export_mount_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+mount\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_media_export_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_media_export_mount_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+mount\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_syscall_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_syscall_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+(\-F\s+arch=(b64|b32)\s+)?\-S\s+sethostname\s+\-S\s+setdomainname\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_system_privileged_commands:obj:1" comment="system files with setuid or setgid permission set" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local" max_depth="-1"/>
      <unix:path operation="equals">/</unix:path>
      <!-- [a-z]+ regex below is a workaround for OpenSCAP https://fedorahosted.org/openscap/ticket/457 bug -->
      <unix:filename operation="pattern match">[a-z]+</unix:filename>
      <filter action="include">oval:ssg-state_setuid_or_setgid_set:ste:1</filter>
      <filter action="exclude">oval:ssg-state_dev_proc_sys_dirs:ste:1</filter>
    </unix:file_object>
    <ind:variable_object id="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_count_of_suid_sgid_binaries_on_system:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arpc_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(-a always,exit -F path=[^\n]+ -F perm=x -F auid&gt;=1000 -F auid!=4294967295 -k privileged)[\s]*$</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
      <filter action="exclude">oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1</filter>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arpc_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(-a always,exit -F path=[^\n]+ -F perm=x -F auid&gt;=1000 -F auid!=4294967295 -k privileged)[\s]*$</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
      <filter action="exclude">oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1</filter>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arse_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arse_utmp_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arse_btmp_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arse_wtmp_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arse_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arse_utmp_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arse_btmp_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arse_wtmp_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+[-\w]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_art_adjtimex_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_art_adjtimex_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*-S[\s]+adjtimex[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_art_clock_settime_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+clock_settime[\s]+-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)time-change[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+clock_settime[\s]+-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)time-change[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_art_clock_settime_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+-S[\s]+clock_settime[\s]+-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)time-change[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+-S[\s]+clock_settime[\s]+-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)time-change[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_art_settimeofday_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_art_settimeofday_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*-S[\s]+settimeofday[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_art_stime_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+stime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_art_stime_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*-S[\s]+stime[\s]+.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_artw_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_artw_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*-k[\s]+[\S]+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arufm_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eaccess_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b32\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EACCES\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b32\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EPERM\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eaccess_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b64\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EACCES\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_augenrules:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b64\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EPERM\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_arufm_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eaccess_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b32\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EACCES\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b32\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EPERM\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eaccess_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b64\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EACCES\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-a\s+always,exit\s+\-F\s+arch=b64\s+?\-S\s+creat\s+\-S\s+open\s+\-S\s+openat\s+\-S\s+open_by_handle_at\s+\-S\s+truncate\s+\-S\s+ftruncate\s+\-F\s+exit=\-EPERM\s+\-F\s+auid&gt;=1000\s+\-F\s+auid!=4294967295\s+\-k\s+[-\w]+\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_augenrules:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s+]\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1" version="1">
      <ind:filepath operation="pattern match">/etc/audit/rules\.d/.*\.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_auditctl:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s+]\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1" version="1">
      <ind:filepath>/etc/audit/audit.rules</ind:filepath>
      <ind:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+\-k[\s]+\w+[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1" version="1">
      <ind:filepath>/etc/audisp/plugins.d/syslog.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*active[ ]+=[ ]+yes[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_root:obj:1" comment="log_group = root" version="1">
      <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=[ ]+root[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*admin_space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_flush:obj:1" version="1">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*flush[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*max_log_file[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_num_logs:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*num_logs[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_action:obj:1" version="2">
      <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
      <!-- Allow only space (exactly) as delimiter: https://fedorahosted.org/audit/browser/trunk/src/auditd-config.c#L426 -->
      <!-- Require at least one space before and after the equal sign -->
      <ind:pattern operation="pattern match">^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_banner_etc_issue:obj:1" version="1">
      <ind:filepath>/etc/issue</ind:filepath>
      <ind:pattern var_ref="oval:ssg-login_banner_text:var:1" operation="pattern match"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_bootloader_audit_argument:obj:1" version="1">
      <ind:filepath>/etc/default/grub</ind:filepath>
      <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_bootloader_audit_argument_default:obj:1" version="1">
      <ind:filepath>/etc/default/grub</ind:filepath>
      <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_bootloader_disable_recovery_argument:obj:1" version="1">
      <ind:filepath>/etc/default/grub</ind:filepath>
      <ind:pattern operation="pattern match">^\s*GRUB_DISABLE_RECOVERY=(.*)$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_bootloader_nousb_argument:obj:1" version="1">
      <ind:filepath>/etc/default/grub</ind:filepath>
      <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_bootloader_grub_cfg:obj:1" version="1">
      <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_bootloader_superuser:obj:1" version="1">
      <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*set[\s]+superusers=\"(?i)(?!root|admin|administrator)(?-i).*\"$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_bootloader_password:obj:1" version="1">
      <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_bootloader_uefi_grub_cfg:obj:1" version="1">
      <unix:filepath operation="pattern match">/boot/efi/EFI/(redhat|fedora)/grub.cfg</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_bootloader_uefi_superuser:obj:1" version="1">
      <ind:filepath operation="pattern match">/boot/efi/EFI/(redhat|fedora)/grub.cfg</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*set[\s]+superusers=\"(?i)(?!root|admin|administrator)(?-i).*\"$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_bootloader_uefi_password:obj:1" version="1">
      <ind:filepath operation="pattern match">/boot/efi/EFI/(redhat|fedora)/grub.cfg</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_cups_disable_browsing_browsing_off:obj:1" version="2">
      <ind:filepath>/etc/cups/cupsd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*Browsing[\s]+(?:Off|No)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_cups_disable_browsing_browseallow:obj:1" version="2">
      <ind:filepath>/etc/cups/cupsd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*BrowseAllow[\s]+(?:none)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_cups_disable_printserver_disable_port:obj:1" version="2">
      <ind:filepath>/etc/cups/cupsd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*Port[\s]+(\d)+</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_cups_disable_printserver_use_listen:obj:1" version="2">
      <ind:filepath>/etc/cups/cupsd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*Listen[\s]+(?:localhost|127\.0\.0\.1|::1):(\d)+</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_banner_gui_enabled:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?banner-message-enable=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-enable$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling]([^\n]*\n+)+?automount=false$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling]([^\n]*\n+)+?automount-open=false$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount-open$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling]([^\n]*\n+)+?autorun-never=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_autorun:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/autorun-never$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/settings-daemon/plugins/media-keys]([^\n]*\n+)+?logout=''$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/settings-daemon/plugins/media-keys/logout$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_sys_geolocation:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/system/location]([^\n]*\n+)+?enabled=false$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_sys_geolocation:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/system/location/enabled$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_clock_geolocation:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/clocks]([^\n]*\n+)+?geolocation=false$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_clock_geolocation:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/clocks/geolocation$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_gnome_power_setting:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/settings-daemon/plugins/power/active]([^\n]*\n+)+?active=false$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_power_setting_change:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/settings-daemon/plugins/power/active$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_restart_buttons:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?disable-restart-buttons=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/login-screen/disable-restart-buttons$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_gnome_disable_thumbnailers:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/desktop/thumbnailers]([^\n]*\n+)+?disable-all=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_gnome_thumbnailers:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/thumbnailers/disable-all$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_gnome_user_admin:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/desktop/lockdown]([^\n]*\n+)+?user-administratrion-enabled=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_admin:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/lockdown/user-administration-disabled$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_user_list:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?disable-user-list=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_disable_user_list:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/login-screen/disable-user-list$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_wifi_creation:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/nm-applet]([^\n]*\n+)+?disable-wifi-create=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_wifi_creation:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/nm-applet/disable-wifi-create$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_wifi_notification:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/nm-applet]([^\n]*\n+)+?suppress-wireless-networks-available=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_wifi_notification:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/nm-applet/suppress-wireless-networks-available$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_enable_gnome_smartcard:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?enable-smartcard-authentication=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_disable_smartcard:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/login-screen/enable-smartcard-authentication$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_change:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-text$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_gdm_login_banner_text_setting:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^banner-message-text=[\s']*([^']*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_configure_allowed_failures:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?allowed-failures=3$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_allowed-failures_change:obj:1" version="1">
      <ind:path>/etc/dconf/db/gdm.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/login-screen/allowed-failures$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_creds:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/Vino]([^\n]*\n+)+?authentication-methods=\['vnc'\]$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_creds:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/Vino/authentication-methods$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_encryption:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/Vino]([^\n]*\n+)+?require-encryption=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/Vino/require-encryption$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?idle-activation-enabled=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/idle-activation-enabled$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <!-- GSettings expects unsigned integer when setting 'idle-delay' per:
         https://bugzilla.redhat.com/show_bug.cgi?id=1141779#c3
         Thus require the proper datatype to be specified in 'idle-delay' configuration too -->
      <ind:pattern operation="pattern match">^\[org/gnome/desktop/session]([^\n]*\n+)+?idle-delay=uint32[\s][0-9]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_delay:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/session/idle-delay$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay_setting:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <!-- GSettings expects unsigned integer when setting 'idle-delay' per:
         https://bugzilla.redhat.com/show_bug.cgi?id=1141779#c3
         Thus require the proper datatype to be specified in 'idle-delay' configuration too -->
      <ind:pattern operation="pattern match">^idle-delay[\s=]*uint32[\s]([^=\s]*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_delay:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <!-- GSettings expects unsigned integer when setting 'lock-delay' per:
         https://bugzilla.redhat.com/show_bug.cgi?id=1141779#c3
         Thus require the proper datatype to be specified in 'lock-delay' configuration too -->
      <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?lock-delay=uint32[\s]0$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_lock_delay:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-delay$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_enabled:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?lock-enabled=true$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_lock:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-enabled$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_mode_blank:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <!-- GSettings expects proper datatype specifier when setting 'picture-uri' per:
         https://bugzilla.redhat.com/show_bug.cgi?id=1141779#c3
         Thus require 'string' datatype to be specified in 'picture-uri' configuration too -->
      <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?picture-uri=string[\s]\'\'$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/picture-uri$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_disable_user_info:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?show-full-name-in-top-bar=false$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_info_change:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/show-full-name-in-top-bar$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_user_change_idle_delay_lock:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/session/idle-delay$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_user_change_lock_delay_lock:obj:1" version="1">
      <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-delay$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="/etc/httpd/conf/" id="oval:ssg-object_dir_perms_etc_httpd_conf:obj:1" version="1">
      <unix:path>/etc/httpd/conf</unix:path>
      <unix:filename xsi:nil="true"/>
    </unix:file_object>
    <unix:file_object comment="/var/log/httpd/" id="oval:ssg-object_dir_perms_var_log_httpd:obj:1" version="1">
      <unix:path>/var/log/httpd</unix:path>
      <unix:filename xsi:nil="true"/>
    </unix:file_object>
    <unix:file_object comment="only local directories" id="oval:ssg-object_only_local_directories:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_world_writable_and_not_sticky:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="all local directories" id="oval:ssg-all_local_directories:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_gid_is_user_and_world_writable:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_sshd_hostbasedauthentication:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)HostbasedAuthentication(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_disable_interactive_boot_grub_cmdline_linux:obj:1" version="1">
      <ind:filepath>/etc/default/grub</ind:filepath>
      <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX=".*systemd.confirm_spawn=(?:1|yes|true|on).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_disable_interactive_boot_grub_cmdline_linux_default:obj:1" version="1">
      <ind:filepath>/etc/default/grub</ind:filepath>
      <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=".*systemd.confirm_spawn=(?:1|yes|true|on).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_prelinking_disabled:obj:1" version="2">
      <ind:filepath>/etc/sysconfig/prelink</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*PRELINKING=no[\s]*</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_core_dumps_limitsconf:obj:1" version="1">
      <ind:filepath>/etc/security/limits.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_display_login_attempts:obj:1" version="1">
      <!-- Read whole /etc/pam.d/postlogin as single line so we can verify form
         of both pam_lastlog.so rows and their order -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/pam.d/postlogin</ind:filepath>
      <ind:pattern operation="pattern match">[\n][\s]*session[\s]+\[default=1\][\s]+pam_lastlog.so[\s\w\d\=]+showfailed[\s\w\d\=]*\n[\s]*session[\s]+optional[\s]+pam_lastlog.so[\s\w\d\=]+showfailed[\s\w\d\=]*[\n]</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_dconf_user_profile:obj:1" version="2">
      <ind:filepath>/etc/dconf/profile/user</ind:filepath>
      <ind:pattern operation="pattern match">^user-db:user\nsystem-db:local$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_selinux_default_grub:obj:1" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found" version="1">
      <ind:filepath>/etc/default/grub</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*GRUB_CMDLINE_LINUX.*(selinux|enforcing)=0.*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_selinux_grub2_cfg:obj:1" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found" version="1">
      <ind:filepath>/etc/grub2.cfg</ind:filepath>
      <ind:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_selinux_grub_dir:obj:1" comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found" version="1">
      <ind:path>/etc/grub.d</ind:path>
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_globally_activated:obj:1" comment="gpgcheck set in /etc/yum.conf" version="1">
      <ind:filepath>/etc/yum.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_dnf_ensure_gpgcheck_globally_activated:obj:1" comment="gpgcheck set in /etc/dnf/dnf.conf" version="1">
      <ind:filepath>/etc/dnf/dnf.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1" version="1">
      <ind:path>/etc/yum.repos.d</ind:path>
      <ind:filename operation="pattern match">.*</ind:filename>
      <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*0\s*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_logrotate_conf_daily_setting:obj:1" version="2">
      <!-- Read whole /etc/logrotate.conf at once (as single line) -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/logrotate.conf</ind:filepath>
      <!-- From the content extract the text chunk after the last (uncommented)
         occurrence of 'daily' keyword till the EOF (including the 'daily'
         string itself) -->
      <ind:pattern operation="pattern match">(?:daily)*.*(?=[\n][\s]*daily)(.*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
      <!-- From the found object exclude that one containing some (uncommented)
         occurrence of (weekly / monthly / yearly) outside the {} block section
         of /etc/logrotate.conf -->
      <filter action="exclude">oval:ssg-state_another_rotate_interval_after_daily:ste:1</filter>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_cron_daily_logrotate_existence:obj:1" version="1">
      <ind:filepath>/etc/cron.daily/logrotate</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*/usr/sbin/logrotate[\s]*/etc/logrotate.conf(?:.*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object id="oval:ssg-object_package_gpg-pubkey:obj:1" version="1">
      <linux:name>gpg-pubkey</linux:name>
    </linux:rpminfo_object>
    <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_group_owner_grub2_cfg:obj:1" version="1">
      <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/boot/efi/EFI/redhat/grub.cfg" id="oval:ssg-object_file_group_owner_efi_grub2_cfg:obj:1" version="1">
      <unix:filepath>/boot/efi/EFI/redhat/grub.cfg</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/group" id="oval:ssg-object_file_groupowner_etc_group:obj:1" version="1">
      <unix:filepath>/etc/group</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_file_groupowner_etc_gshadow:obj:1" version="1">
      <unix:filepath>/etc/gshadow</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/passwd" id="oval:ssg-object_file_groupowner_etc_passwd:obj:1" version="1">
      <unix:filepath>/etc/passwd</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/group" id="oval:ssg-object_file_owner_etc_group:obj:1" version="1">
      <unix:filepath>/etc/group</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_file_owner_etc_gshadow:obj:1" version="1">
      <unix:filepath>/etc/gshadow</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/passwd" id="oval:ssg-object_file_owner_etc_passwd:obj:1" version="1">
      <unix:filepath>/etc/passwd</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="binary directories" id="oval:ssg-object_file_ownership_binary_directories:obj:1" version="1">
      <!-- Check that /bin, /sbin, /usr/sbin, /usr/sbin, /usr/local/bin,
         /usr/local/sbin, and /usr/libexec directories belong to user with uid 0 (root) -->
      <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="binary files" id="oval:ssg-object_file_ownership_binary_files:obj:1" version="1">
      <!-- Check that files within /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
         /usr/local/sbin, and /usr/libexec directories belong to user with uid 0 (root) -->
      <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="library directories" id="oval:ssg-object_file_ownership_lib_dir:obj:1" version="1">
      <!-- Check that /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to user with uid 0 (root) -->
      <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_libraries_not_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="library files" id="oval:ssg-object_file_ownership_lib_files:obj:1" version="1">
      <!-- Check that files within /lib, /lib64, /usr/lib, and /usr/lib64 directories belong to user with uid 0 (root) -->
      <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_libraries_not_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="binary files" id="oval:ssg-object_file_permissions_binary_files:obj:1" version="1">
      <!-- Check that binary files under /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
         /usr/local/sbin, and /usr/libexec directories have safe permissions (go-w) -->
      <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1</filter>
      <filter action="exclude">oval:ssg-state_perms_binary_files_symlink:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/etc/group" id="oval:ssg-object_file_permissions_etc_group:obj:1" version="1">
      <unix:filepath>/etc/group</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_etc_gshadow:obj:1" version="1">
      <unix:filepath>/etc/gshadow</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/passwd" id="oval:ssg-object_etc_passwd:obj:1" version="1">
      <unix:filepath>/etc/passwd</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/etc/shadow" id="oval:ssg-object_etc_shadow:obj:1" version="1">
      <unix:filepath>/etc/shadow</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_permissions_grub2_cfg:obj:1" version="1">
      <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/boot/efi/EFI/redhat/grub.cfg" id="oval:ssg-object_file_permissions_efi_grub2_cfg:obj:1" version="1">
      <unix:filepath>/boot/efi/EFI/redhat/grub.cfg</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="home directories" id="oval:ssg-object_file_permissions_home_dirs:obj:1" version="2">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
      <unix:path operation="equals">/home</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="exclude">oval:ssg-state_home_dirs_home_itself:ste:1</filter>
      <filter action="include">oval:ssg-state_home_dirs_wrong_perm:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/etc/httpd/conf/* permissions" id="oval:ssg-object_file_permissions_httpd_server_conf_files:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/etc/httpd/conf</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="library directories" id="oval:ssg-object_file_permissions_lib_dir:obj:1" version="1">
      <!-- Check that /lib, /lib64, /usr/lib, /usr/lib64 directories have safe permissions (go-w) -->
      <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
      <unix:filename xsi:nil="true"/>
      <filter action="include">oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1</filter>
      <filter action="exclude">oval:ssg-perms_state_symlink:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="library files" id="oval:ssg-object_file_permissions_lib_files:obj:1" version="1">
      <!-- Check the files within /lib, /lib64, /usr/lib, /usr/lib64 directories have safe permissions (go-w) -->
      <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1</filter>
      <filter action="exclude">oval:ssg-perms_state_symlink:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="world writable" id="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_file_permissions_unauthorized_world_write:ste:1</filter>
      <!-- don't search /proc, /sys, and some special files from /selinux -->
      <filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1</filter>
      <filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1</filter>
      <filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="all local files" id="oval:ssg-object_file_permissions_ungroupowned:obj:1" version="1">
      <!-- We can't traverse symlinks here since e.g. /sys file system might contain symlink loops
         resulting into excessive memory use by the scanner process & possible subsequent OOM killer
         termination of it. See e.g.: https://www.redhat.com/archives/open-scap-list/2014-May/msg00005.html
         Therefore traverse only directories -->
      <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
      <unix:path>/</unix:path>
      <unix:filename operation="pattern match">.*</unix:filename>
      <filter action="exclude">oval:ssg-state_file_permissions_ungroupowned:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-etc_group_object:obj:1" version="1">
      <ind:filepath>/etc/group</ind:filepath>
      <ind:pattern operation="pattern match">^[^:]+:[^:]*:([\d]+):[^:]*$</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_files-non_root:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_not_mode_0640:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_files:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
      <unix:path operation="equals">/var/log/audit</unix:path>
      <unix:filename operation="pattern match">^.*$</unix:filename>
      <filter action="include">oval:ssg-state_not_mode_0600:ste:1</filter>
    </unix:file_object>
    <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_user_owner_grub2_cfg:obj:1" version="1">
      <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
    </unix:file_object>
    <unix:file_object comment="/boot/efi/EFI/redhat/grub.cfg" id="oval:ssg-object_file_user_owner_efi_grub2_cfg:obj:1" version="1">
      <unix:filepath>/boot/efi/EFI/redhat/grub.cfg</unix:filepath>
    </unix:file_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_service_sshd:obj:1" version="1">
      <ind:path>/etc/firewalld/services</ind:path>
      <ind:filename operation="pattern match">^.*\.xml$</ind:filename>
      <ind:xpath>/service/service[@name='ssh']</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_service_sshd_port:obj:1" version="1">
      <ind:path>/etc/firewalld/services</ind:path>
      <ind:filename operation="pattern match">^.*\.xml$</ind:filename>
      <ind:xpath>/service/port[@port='22']</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_zone_sshd:obj:1" version="1">
      <ind:path>/etc/firewalld/zones</ind:path>
      <ind:filename operation="pattern match">^.*\.xml$</ind:filename>
      <ind:xpath>/zone/service[@name='ssh']</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_zone_sshd_port:obj:1" version="1">
      <ind:path>/etc/firewalld/zones</ind:path>
      <ind:filename operation="pattern match">^.*\.xml$</ind:filename>
      <ind:xpath>/zone/port[@port='22']</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_service_sshd_enabled:obj:1" version="1">
      <ind:path>/etc/firewalld/services</ind:path>
      <ind:filename operation="pattern match">^.*\.xml$</ind:filename>
      <ind:xpath>/service/service[@name='ssh']</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:textfilecontent54_object id="oval:ssg-object_firewalld_service_sshd_port_enabled:obj:1" version="1">
      <ind:path>/etc/firewalld/services</ind:path>
      <ind:filename operation="pattern match">^.*\.xml$</ind:filename>
      <ind:pattern operation="pattern match">&lt;port.*port="(\d+)"</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:xmlfilecontent_object id="oval:ssg-object_firewalld_zone_sshd_enabled:obj:1" version="1">
      <ind:path>/etc/firewalld/zones</ind:path>
      <ind:filename operation="pattern match">^.*\.xml$</ind:filename>
      <ind:xpath>/zone/service[@name='ssh']</ind:xpath>
    </ind:xmlfilecontent_object>
    <ind:textfilecontent54_object id="oval:ssg-object_firewalld_zone_sshd_port_enabled:obj:1" version="1">
      <ind:path>/etc/firewalld/zones</ind:path>
      <ind:filename operation="pattern match">^.*\.xml$</ind:filename>
      <ind:pattern operation="pattern match">&lt;port.*port="(\d+)"</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_enable:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*xferlog_enable[\s]*=[\s]*YES$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_format:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*xferlog_std_format[\s]*=[\s]*NO$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*log_ftp_protocol[\s]*=[\s]*YES$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Banner for FTP Users" id="oval:ssg-object_test_ftp_present_banner:obj:1" version="1">
      <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*banner_file[\s]*=[\s]*/etc/issue*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same_var:obj:1" version="1">
      <ind:filepath>/etc/group</ind:filepath>
      <!-- Group ID (GID) from /etc/group (3-rd column) captured as subexpression of this object -->
      <ind:pattern operation="pattern match">^.*:x:([0-9]+):</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <!-- Group ID (GID) from /etc/passwd (4-th column) captured as subexpression of this object -->
      <ind:pattern operation="pattern match">^.*:[0-9]+:([0-9]+):</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_automatic_login:obj:1" version="1">
      <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?AutomaticLoginEnable=[Ff]alse$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_disable_guest_login:obj:1" version="1">
      <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?TimedLoginEnable=[Ff]alse$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="/etc/shadow" id="oval:ssg-object_groupowner_shadow_file:obj:1" version="1">
      <unix:filepath>/etc/shadow</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_selinux_enforcing:obj:1" version="1">
      <ind:filepath>/etc/selinux/config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*enforcing[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:rpminfo_object id="oval:ssg-obj_linuxshield_install_antivirus:obj:1" version="1">
      <linux:name>McAfeeVSEForLinux</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_runtime_installed:obj:1" version="1">
      <linux:name>MFErt</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_management_agent:obj:1" version="1">
      <linux:name>MFEcma</linux:name>
    </linux:rpminfo_object>
    <unix:file_object id="oval:ssg-object_mcafee_accm_exists:obj:1" version="1">
      <unix:path>/opt/McAfee/accm/bin</unix:path>
      <unix:filename>accm</unix:filename>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_mcafee_hbss_hips_installed:obj:1" version="1">
      <linux:name>MFEhiplsm</linux:name>
    </linux:rpminfo_object>
    <unix:file_object id="oval:ssg-object_mcafee_auditengine_exists:obj:1" version="1">
      <unix:path>/opt/McAfee/auditengine/bin</unix:path>
      <unix:filename>auditmanager</unix:filename>
    </unix:file_object>
    <linux:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
      <linux:name>centos-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
      <linux:name>centos-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
      <linux:name>fedora-release</linux:name>
    </linux:rpminfo_object>
    <ind:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
      <ind:filepath>/etc/system-release-cpe</ind:filepath>
      <ind:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_workstation:obj:1" version="1">
      <linux:name>redhat-release-workstation</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_server:obj:1" version="1">
      <linux:name>redhat-release-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel_computenode:obj:1" version="1">
      <linux:name>redhat-release-computenode</linux:name>
    </linux:rpminfo_object>
    <ind:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
      <linux:name>redhat-release-workstation</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
      <linux:name>redhat-release-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
      <linux:name>redhat-release-computenode</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
      <linux:name>sl-release</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
      <linux:name>sl-release</linux:name>
    </linux:rpminfo_object>
    <ind:family_object id="oval:ssg-obj_unix_wrlinux:obj:1" version="1"/>
    <unix:file_object version="1" id="oval:ssg-obj_test_wrlinux:obj:1">
      <unix:filepath>/etc/wrlinux-release</unix:filepath>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_disabled:obj:1" version="1" comment="kernel module dccp disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of dccp">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_etcmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /etc/modules-load.d">
      <ind:path>/etc/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_runmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /run/modules-load.d">
      <ind:path>/run/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_libmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /usr/lib/modules-load.d">
      <ind:path>/usr/lib/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1" version="1" comment="kernel module usb-storage disabled">
      <ind:path>/etc/modprobe.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of usb-storage">
      <ind:filepath>/etc/modprobe.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_etcmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /etc/modules-load.d">
      <ind:path>/etc/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_runmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /run/modules-load.d">
      <ind:path>/run/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_libmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d">
      <ind:path>/usr/lib/modules-load.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_ldap_client_start_tls_ssl:obj:1" version="1">
      <ind:filepath>/etc/nslcd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*ssl[\s]+start_tls[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_ldap_client_tls_cacertdir:obj:1" version="1">
      <ind:filepath>/etc/nslcd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*tls_cacertdir[\s]+/etc/pki/tls/CA$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_ldap_client_tls_cacertfile:obj:1" version="1">
      <ind:filepath>/etc/nslcd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*tls_cacertfile[\s]+/etc/pki/tls/CA/.*\.(pem|crt)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_logwatch_configured_hostlimit:obj:1" version="1">
      <ind:filepath>/etc/logwatch/conf/logwatch.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*no[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_logwatch_configured_splithosts:obj:1" version="1">
      <ind:filepath>/etc/logwatch/conf/logwatch.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*yes[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_dev_shm_partition_nodev:obj:1" version="1">
      <linux:mount_point>/dev/shm</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_dev_shm_partition_noexec:obj:1" version="1">
      <linux:mount_point>/dev/shm</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_dev_shm_partition_nosuid:obj:1" version="1">
      <linux:mount_point>/dev/shm</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_non_root_partitions:obj:1" version="1">
      <!-- look at all partitions except root -->
      <linux:mount_point operation="pattern match">^/\w.*$</linux:mount_point>
      <filter action="include">oval:ssg-state_local_nodev:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nfs_nodev_etc_fstab:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^\s*\[?[\.\w-:]+\]?:[/\w-]+\s+[/\w-]+\s+nfs[4]?\s+(.*)$</ind:pattern>
      <!-- the "not equal" operation essentially means all instances of the regexp -->
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_no_nfs_defined_etc_fstab_nodev:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^\s*\[?[\.\w-:]+\]?:[/\w-]+\s+[/\w-]+\s+nfs[4]?\s+.*$</ind:pattern>
      <!-- the "not equal" operation below essentially means all instances of the regexp -->
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_nodev_runtime_cd_dvd_drive:obj:1" version="1">
      <!-- CD / DVD drive can be mounted under any mount_point. We don't know ahead its exact name.
         => Capture all & filter out only the relevant ones via the corresponding state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- Therefore from all the captured mount points select only those having
         device set to some CD / DVD drive alternative name and simultaneously
         having 'nodev' mount option used -->
      <filter action="include">oval:ssg-state_nodev_runtime_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_nodev_runtime_not_cd_dvd_drive:obj:1" version="1">
      <!-- Removable partition can be mounted under any mount point. We don't know it's
         exact name ahead => capture all & filter out only those relevant later via state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- From all the captured mount points select only those having device equal
         to 'var_removable_partition' variable value and simultaneously having
         'nodev' mount option set -->
      <filter action="include">oval:ssg-state_nodev_runtime_not_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_noexec_runtime_cd_dvd_drive:obj:1" version="1">
      <!-- CD / DVD drive can be mounted under any mount_point. We don't know ahead its exact name.
         => Capture all & filter out only the relevant ones via the corresponding state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- Therefore from all the captured mount points select only those having
         device set to some CD / DVD drive alternative name and simultaneously
         having 'noexec' mount option used -->
      <filter action="include">oval:ssg-state_noexec_runtime_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_noexec_runtime_not_cd_dvd_drive:obj:1" version="1">
      <!-- Removable partition can be mounted under any mount point. We don't know it's
         exact name ahead => Capture all & filter out only those relevant later via state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- From all the captured mount points select only those having device equal
         to 'var_removable_partition' variable value and simultaneously having
         'noexec' mount option set -->
      <filter action="include">oval:ssg-state_noexec_runtime_not_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nfs_nosuid_etc_fstab:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^\s*\[?[\.\w-:]+\]?:[/\w-]+\s+[/\w-]+\s+nfs[4]?\s+(.*)$</ind:pattern>
      <!-- the "not equal" operation essentially means all instances of the regexp -->
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_no_nfs_defined_etc_fstab_nosuid:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^\s*\[?[\.\w-:]+\]?:[/\w-]+\s+[/\w-]+\s+nfs[4]?\s+.*$</ind:pattern>
      <!-- the "not equal" operation below essentially means all instances of the regexp -->
      <ind:instance datatype="int" operation="not equal">0</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_nosuid_runtime_cd_dvd_drive:obj:1" version="1">
      <!-- CD / DVD drive can be mounted under any mount_point. We don't know ahead its exact name.
         => Capture all & filter out only the relevant ones via the corresponding state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- Therefore from all the captured mount points select only those having
         device set to some CD / DVD drive alternative name and simultaneously
         having 'nosuid' mount option used -->
      <filter action="include">oval:ssg-state_nosuid_runtime_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern:var:1" var_check="at least one"/>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_nosuid_runtime_not_cd_dvd_drive:obj:1" version="1">
      <!-- Removable partition can be mounted under any mount point. We don't know it's
         exact name ahead => capture all & filter out only those relevant later via state -->
      <linux:mount_point operation="pattern match">^.*$</linux:mount_point>
      <!-- From all the captured mount points select only those having device equal
         to 'var_removable_partition' variable value and simultaneously having
         'nosuid' mount option set -->
      <filter action="include">oval:ssg-state_nosuid_runtime_not_cd_dvd_drive:ste:1</filter>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_20340111:obj:1" version="1">
      <ind:filepath>/etc/fstab</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+[\S]+[\s]+cifs[\s]+([\S]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_20340112:obj:1" version="1">
      <ind:filepath>/etc/mtab</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+[\S]+[\s]+cifs[\s]+([\S]+)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:partition_object id="oval:ssg-object_tmp_nodev_partition:obj:1" version="1">
      <linux:mount_point>/tmp</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_tmp_noexec_partition:obj:1" version="1">
      <linux:mount_point>/tmp</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_tmp_nosuid_partition:obj:1" version="1">
      <linux:mount_point>/tmp</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_option_var_tmp:obj:1" version="1">
      <linux:mount_point operation="pattern match">/var/tmp</linux:mount_point>
    </linux:partition_object>
    <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab" id="oval:ssg-object_mount_option_var_tmp_bind:obj:1" version="1">
      <ind:filepath>/etc/mtab</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">
    1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1" version="1">
      <ind:filepath>/etc/sysconfig/network</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*NOZEROCONF[\s]*=[\s]*yes</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Define default gateways" id="oval:ssg-obj_network_ipv6_default_gateway:obj:1" version="1">
      <ind:path>/etc/sysconfig/network-scripts</ind:path>
      <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
      <ind:pattern operation="pattern match">^IPV6_DEFAULTGW=.+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Test for udp6 based rpc services" id="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1" version="1">
      <ind:filepath>/etc/netconfig</ind:filepath>
      <ind:pattern operation="pattern match">^udp6\s+tpi_clts\s+v\s+inet6\s+udp\s+-\s+-$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Test for tcp6 based rpc services" id="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1" version="1">
      <ind:filepath>/etc/netconfig</ind:filepath>
      <ind:pattern operation="pattern match">^tcp6\s+tpi_cots_ord\s+v\s+inet6\s+tcp\s+-\s+-$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Enable privacy extensions on each interface" id="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1" version="1">
      <ind:path>/etc/sysconfig/network-scripts</ind:path>
      <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
      <ind:pattern operation="pattern match">^IPV6_PRIVACY=rfc3041$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="Set static IPv6 address on each interface" id="oval:ssg-obj_network_ipv6_static_address:obj:1" version="1">
      <ind:path>/etc/sysconfig/network-scripts</ind:path>
      <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
      <ind:pattern operation="pattern match">^IPV6ADDR=.+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:interface_object id="oval:ssg-object_promisc_interfaces:obj:1" version="1">
      <unix:name operation="pattern match">^.*$</unix:name>
      <filter action="include">oval:ssg-state_promisc:ste:1</filter>
    </unix:interface_object>
    <ind:textfilecontent54_object comment="/etc/securetty file exists" id="oval:ssg-object_etc_securetty_exists:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="no entries /etc/securetty" id="oval:ssg-object_no_direct_root_logins:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_no_empty_passwords:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">\s*nullok\s*</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-file_permissions_unowned_userid_list_object:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <ind:pattern operation="pattern match">^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$</ind:pattern>
      <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="all local files" id="oval:ssg-file_permissions_unowned_object:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
      <unix:path>/</unix:path>
      <unix:filename operation="pattern match">.*</unix:filename>
      <filter action="exclude">oval:ssg-file_permissions_unowned_userid_list_match:ste:1</filter>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_no_insecure_locks_exports:obj:1" version="2">
      <ind:filepath>/etc/exports</ind:filepath>
      <ind:pattern operation="pattern match">^(.*?(\binsecure_locks\b)[^$]*)$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="look for .netrc in /home" id="oval:ssg-object_no_netrc_files_home:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
      <unix:path operation="equals">/home</unix:path>
      <unix:filename operation="pattern match">^\.netrc$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="look for .rhosts or .shosts in /root" id="oval:ssg-object_no_rsh_trust_files_root:obj:1" version="1">
      <unix:path operation="equals">/root</unix:path>
      <unix:filename operation="pattern match">^\.(r|s)hosts$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="look for .rhosts or .shosts in /home" id="oval:ssg-object_no_rsh_trust_files_home:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
      <unix:path operation="equals">/home</unix:path>
      <unix:filename operation="pattern match">^\.(r|s)hosts$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="look for /etc/hosts.equiv or /etc/shosts.equiv" id="oval:ssg-object_no_rsh_trust_files_etc:obj:1" version="1">
      <unix:path operation="equals">/etc</unix:path>
      <unix:filename operation="pattern match">^s?hosts\.equiv$</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance od UID_MIN directive -->
      <ind:pattern operation="pattern match">.*\n(?!#|SYS_)(UID_MIN[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance of SYS_UID_MIN directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MIN[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1" version="1">
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Last (uncommented) instance of SYS_UID_MAX directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MAX[\s]+[\d]+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_entries:obj:1" version="1">
      <ind:filepath>/etc/passwd</ind:filepath>
      <ind:pattern operation="pattern match">^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_default_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_default_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_reserved_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_reserved_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_shell_defined_dynalloc_uid_range:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_dynalloc_range_quad_expr:var:1</ind:var_ref>
    </ind:variable_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_dracut-fips_installed:obj:1" version="1">
      <linux:name>dracut-fips</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_gdm_installed:obj:1" version="1">
      <linux:name>gdm</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_libreswan_installed:obj:1" version="1">
      <linux:name>libreswan</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_mcstrans_removed:obj:1" version="1">
      <linux:name>mcstrans</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_nss-pam-ldapd_removed:obj:1" version="1">
      <linux:name>nss-pam-ldapd</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_openldap-servers_removed:obj:1" version="1">
      <linux:name>openldap-servers</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_prelink_removed:obj:1" version="1">
      <linux:name>prelink</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_rsh-server_removed:obj:1" version="1">
      <linux:name>rsh-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_rsh_removed:obj:1" version="1">
      <linux:name>rsh</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_rsyslog_installed:obj:1" version="1">
      <linux:name>rsyslog</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_samba-common_installed:obj:1" version="1">
      <linux:name>samba-common</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_samba-common_removed:obj:1" version="1">
      <linux:name>samba-common</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_screen_installed:obj:1" version="1">
      <linux:name>screen</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_sendmail_removed:obj:1" version="1">
      <linux:name>sendmail</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_setroubleshoot_removed:obj:1" version="1">
      <linux:name>setroubleshoot</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_talk-server_removed:obj:1" version="1">
      <linux:name>talk-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_talk_removed:obj:1" version="1">
      <linux:name>talk</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_telnet-server_removed:obj:1" version="1">
      <linux:name>telnet-server</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_telnet_removed:obj:1" version="1">
      <linux:name>telnet</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_tftp_removed:obj:1" version="1">
      <linux:name>tftp</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_xorg-x11-server-common_removed:obj:1" version="1">
      <linux:name>xorg-x11-server-common</linux:name>
    </linux:rpminfo_object>
    <linux:rpminfo_object id="oval:ssg-obj_package_ypserv_removed:obj:1" version="1">
      <linux:name>ypserv</linux:name>
    </linux:rpminfo_object>
    <linux:partition_object id="oval:ssg-object_mount_home_own_partition:obj:1" version="1">
      <linux:mount_point>/home</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_own_tmp_partition:obj:1" version="1">
      <linux:mount_point>/tmp</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_own_partition:obj:1" version="1">
      <linux:mount_point>/var</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_log_own_partition:obj:1" version="1">
      <linux:mount_point>/var/log</linux:mount_point>
    </linux:partition_object>
    <linux:partition_object id="oval:ssg-object_mount_var_log_audit_own_partition:obj:1" version="1">
      <linux:mount_point>/var/log/audit</linux:mount_point>
    </linux:partition_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_postfix_server_banner:obj:1" version="1">
      <ind:filepath>/etc/postfix/main.cf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*smtpd_banner[\s]*=[\s]*\$myhostname[\s]+ESMTP[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object id="oval:ssg-object_removable_partition_doesnt_exist:obj:1" version="1">
      <unix:filepath var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_require_rescue_service:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/rescue.service</ind:filepath>
      <ind:pattern operation="pattern match">^ExecStart=\-.*/sbin/sulogin</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_require_rescue_service_runlevel1:obj:1" version="1">
      <ind:filepath>/usr/lib/systemd/system/runlevel1.target</ind:filepath>
      <ind:pattern operation="pattern match">^Requires=.*rescue.service</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:file_object comment="look for rescue.service in /etc/systemd/system" id="oval:ssg-object_no_custom_rescue_service:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
      <unix:path operation="equals">/etc/systemd/system</unix:path>
      <unix:filename operation="pattern match">^rescue.service$</unix:filename>
    </unix:file_object>
    <unix:file_object comment="look for runlevel1.target in /etc/systemd/system" id="oval:ssg-object_no_custom_runlevel1_target:obj:1" version="1">
      <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
      <unix:path operation="equals">/etc/systemd/system</unix:path>
      <unix:filename operation="pattern match">^runlevel1.target$</unix:filename>
    </unix:file_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_require_smb_client_signing:obj:1" version="1">
      <ind:filepath>/etc/samba/smb.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*client[\s]+signing[\s]*=[\s]*mandatory</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="serial ports /etc/securetty" id="oval:ssg-object_serial_ports_etc_securetty:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^ttyS[0-9]+$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:environmentvariable58_object id="oval:ssg-object_root_path_no_dot:obj:1" version="1">
      <ind:pid xsi:nil="true" datatype="int"/>
      <ind:name>PATH</ind:name>
    </ind:environmentvariable58_object>
    <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_md5_hash:obj:1" version="1" comment="rpm verify of all files">
      <linux:behaviors nomd5="false"/>
      <linux:name operation="pattern match">.*</linux:name>
      <linux:epoch operation="pattern match">.*</linux:epoch>
      <linux:version operation="pattern match">.*</linux:version>
      <linux:release operation="pattern match">.*</linux:release>
      <linux:arch operation="pattern match">.*</linux:arch>
      <linux:filepath operation="pattern match">^.*bin/.*$</linux:filepath>
      <filter action="include">oval:ssg-state_files_fail_md5_hash:ste:1</filter>
    </linux:rpmverifyfile_object>
    <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_user_ownership:obj:1" version="1" comment="rpm verify of all files">
      <linux:behaviors nomd5="true" noghostfiles="true"/>
      <linux:name operation="pattern match">.*</linux:name>
      <linux:epoch operation="pattern match">.*</linux:epoch>
      <linux:version operation="pattern match">.*</linux:version>
      <linux:release operation="pattern match">.*</linux:release>
      <linux:arch operation="pattern match">.*</linux:arch>
      <linux:filepath operation="pattern match">.*</linux:filepath>
      <filter action="include">oval:ssg-state_files_fail_user_ownership:ste:1</filter>
    </linux:rpmverifyfile_object>
    <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_group_ownership:obj:1" version="1" comment="rpm verify of all files">
      <linux:behaviors nomd5="true" noghostfiles="true"/>
      <linux:name operation="pattern match">.*</linux:name>
      <linux:epoch operation="pattern match">.*</linux:epoch>
      <linux:version operation="pattern match">.*</linux:version>
      <linux:release operation="pattern match">.*</linux:release>
      <linux:arch operation="pattern match">.*</linux:arch>
      <linux:filepath operation="pattern match">.*</linux:filepath>
      <filter action="include">oval:ssg-state_files_fail_group_ownership:ste:1</filter>
    </linux:rpmverifyfile_object>
    <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_mode:obj:1" version="1" comment="rpm verify of all files">
      <linux:behaviors nomd5="true" noghostfiles="true"/>
      <linux:name operation="pattern match">.*</linux:name>
      <linux:epoch operation="pattern match">.*</linux:epoch>
      <linux:version operation="pattern match">.*</linux:version>
      <linux:release operation="pattern match">.*</linux:release>
      <linux:arch operation="pattern match">.*</linux:arch>
      <linux:filepath operation="pattern match">.*</linux:filepath>
      <filter action="include">oval:ssg-state_files_fail_mode:ste:1</filter>
    </linux:rpmverifyfile_object>
    <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_nolisten:obj:1" version="2">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*\$(?:Input(?:TCP|RELP)|UDP)ServerRun</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1" version="1">
      <ind:filepath>/etc/rsyslog.conf</ind:filepath>
      <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_d:obj:1" version="1">
      <ind:path>/etc/rsyslog.d</ind:path>
      <ind:filename operation="pattern match">.*</ind:filename>
      <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="virtual consoles /etc/securetty" id="oval:ssg-object_virtual_consoles_etc_securetty:obj:1" version="1">
      <ind:filepath>/etc/securetty</ind:filepath>
      <ind:pattern operation="pattern match">^vc/[0-9]+$</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <linux:selinuxsecuritycontext_object comment="device_t in /dev" id="oval:ssg-object_selinux_all_devicefiles_labeled:obj:1" version="1">
      <linux:behaviors recurse_direction="down"/>
      <linux:path>/dev</linux:path>
      <linux:filename operation="pattern match">^.*$</linux:filename>
      <filter action="include">oval:ssg-state_selinux_all_devicefiles_labeled:ste:1</filter>
    </linux:selinuxsecuritycontext_object>
    <linux:selinuxsecuritycontext_object comment="none satisfy initrc_t in /proc" id="oval:ssg-object_selinux_confinement_of_daemons:obj:1" version="1">
      <linux:behaviors max_depth="1" recurse_direction="down"/>
      <linux:path>/proc</linux:path>
      <linux:filename operation="pattern match">^.*$</linux:filename>
      <filter action="include">oval:ssg-state_selinux_confinement_of_daemons:ste:1</filter>
    </linux:selinuxsecuritycontext_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_selinux_policy:obj:1" version="1">
      <ind:filepath>/etc/selinux/config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*SELINUXTYPE[\s]*=[\s]*([^\s]*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_etc_selinux_config:obj:1" version="1">
      <ind:filepath>/etc/selinux/config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*(.*)[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_firewalld_input_drop:obj:1" version="1">
      <ind:filepath>/etc/firewalld/firewalld.conf</ind:filepath>
      <ind:pattern operation="pattern match">^DefaultZone=drop$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object comment="The password hashing algorithm should be set correctly in /etc/libuser.conf" id="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1" version="1">
      <ind:filepath>/etc/libuser.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*crypt_style[\s]+=[\s]+(?i)sha512[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1" version="1">
      <!-- Read whole /etc/login.defs as single line so we can retrieve last ENCRYPT_METHOD directive occurrence -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/login.defs</ind:filepath>
      <!-- Retrieve last (uncommented) occurrence of ENCRYPT_METHOD directive -->
      <ind:pattern operation="pattern match">.*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-object_last_encrypt_method_instance_value:obj:1" version="1">
      <ind:var_ref>oval:ssg-variable_last_encrypt_method_instance_value:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object comment="check /etc/pam.d/system-auth for correct settings" id="oval:ssg-object_pam_unix_sha512:obj:1" version="1">
      <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_snmp_default_communities:obj:1" version="1">
      <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity|createUser).*(public|private)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_snmp_versions:obj:1" version="1">
      <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_sshd_allow_only_protocol2:obj:1" version="3">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)Protocol[\s]+2[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_permitemptypasswords_no:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)PermitEmptyPasswords(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_rsh_emulation_disabled:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)IgnoreRhosts(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)RhostsRSAAuthentication(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_permitrootlogin_no:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)PermitRootLogin(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)IgnoreUserKnownHosts(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_no_user_envset:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)PermitUserEnvironment(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_banner_set:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_sshd_idle_timeout:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_clientalivecountmax:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_approved_ciphers:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_approved_macs:obj:1" version="1">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+hmac-sha2-512,hmac-sha2-256,hmac-sha1[\s]*(?:|(?:#.*))?$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_sysconfig_networking_bootproto_ifcfg:obj:1" version="1">
      <ind:path>/etc/sysconfig/network-scripts</ind:path>
      <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*BOOTPROTO[\s]*=[\s"]*([^#"\s]*)</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_exec_shield:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.exec-shield[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_exec_shield:obj:1" version="1">
      <unix:name>kernel.exec-shield</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object id="oval:ssg-object_nx_disabled_grub:obj:1" version="1">
      <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
      <ind:pattern operation="pattern match">[\s]*noexec[\s]*=[\s]*off</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:sysctl_object id="oval:ssg-object_runtime_kernel_dmesg_restrict:obj:1" version="1">
      <unix:name>kernel.dmesg_restrict</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_randomize_va_space:obj:1" version="1">
      <unix:name>kernel.randomize_va_space</unix:name>
    </unix:sysctl_object>
    <unix:sysctl_object id="oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
      <unix:name>net.ipv6.conf.all.disable_ipv6</unix:name>
    </unix:sysctl_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctld_kernel_dmesg_restrict:obj:1" version="1">
      <!-- Read whole /etc/sysctl.d/* file as a single line so we can retrieve the last kernel.dmesg_restrict directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:path>/etc/sysctl.d</ind:path>
      <!-- apply_sysctl() routine from /etc/init.d/functions on RHEL-6 applies sysctl configuration from each /etc/sysctl.d/*
         file: https://git.fedorahosted.org/cgit/initscripts.git/tree/rc.d/init.d/functions?h=rhel6-branch#n646 -->
      <ind:filename operation="pattern match">^.*$</ind:filename>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*kernel.dmesg_restrict[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctl_kernel_dmesg_restrict:obj:1" version="1">
      <!-- Read whole /etc/sysctl.conf file as a single line so we can retrieve the last kernel.dmesg_restrict directive instance -->
      <ind:behaviors singleline="true"/>
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*kernel.dmesg_restrict[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
      <ind:filepath>/etc/sysctl.conf</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
      <ind:path>/etc/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
      <ind:path>/run/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
      <ind:path>/usr/lib/sysctl.d</ind:path>
      <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
      <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppc_64:obj:1" version="1"/>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1"/>
    <unix:uname_object comment="32 bit architecture" id="oval:ssg-object_system_info_architecture_x86:obj:1" version="1"/>
    <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_x86_64:obj:1" version="1"/>
    <ind:textfilecontent54_object id="oval:ssg-object_tftpd_uses_secure_mode:obj:1" version="1">
      <ind:filepath>/etc/xinetd.d/tftp</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*server_args[\s]+=[\s]+\-s[\s]+.+$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" comment="Umask value from /etc/init.d/functions" version="1">
      <ind:filepath>/etc/init.d/functions</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
      <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    </ind:textfilecontent54_object>
    <ind:variable_object id="oval:ssg-obj_umask_for_daemons:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_etc_init_d_functions_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <unix:file_object comment="/etc/shadow" id="oval:ssg-object_file_etc_shadow:obj:1" version="1">
      <unix:filepath>/etc/shadow</unix:filepath>
    </unix:file_object>
    <ind:variable_object id="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_accounts_user_umask_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_removable_partition:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:variable_object id="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1" version="1">
      <ind:var_ref>oval:ssg-var_umask_for_daemons_umask_as_number:var:1</ind:var_ref>
    </ind:variable_object>
    <ind:textfilecontent54_object id="oval:ssg-object_wireless_disable_interfaces:obj:1" version="1">
      <ind:filepath>/proc/net/wireless</ind:filepath>
      <ind:pattern operation="pattern match">^\s*[-\w]+:</ind:pattern>
      <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>
  </objects>
  <states>
    <ind:textfilecontent54_state id="oval:ssg-state_docker_storage_driver:ste:1" version="1" comment="devicemapper storage driver">
      <ind:subexpression operation="equals">devicemapper</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_pcscd.socket_on:ste:1" comment="pcscd.socket listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">pcscd.socket</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_abrtd_off:ste:1" comment="abrtd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">abrtd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_acpid_off:ste:1" comment="acpid is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">acpid.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_atd_off:ste:1" comment="atd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">atd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_on:ste:1" comment="auditd listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">auditd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_autofs_off:ste:1" comment="autofs is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">autofs.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_avahi-daemon_off:ste:1" comment="avahi-daemon is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">avahi-daemon.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_bluetooth_off:ste:1" comment="bluetooth is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">bluetooth.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_certmonger_off:ste:1" comment="certmonger is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">certmonger.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_cgconfig_off:ste:1" comment="cgconfig is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">cgconfig.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_cgred_off:ste:1" comment="cgred is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">cgred.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_chronyd_on:ste:1" comment="chronyd listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">chronyd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_cpupower_off:ste:1" comment="cpupower is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">cpupower.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_crond_on:ste:1" comment="crond listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">crond.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_cups_off:ste:1" comment="cups is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">cups.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_debug-shell_off:ste:1" comment="debug-shell is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">debug-shell.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_dhcpd_off:ste:1" comment="dhcpd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">dhcpd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_docker_on:ste:1" comment="docker listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">docker.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_dovecot_off:ste:1" comment="dovecot is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">dovecot.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_firewalld_on:ste:1" comment="firewalld listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">firewalld.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_httpd_off:ste:1" comment="httpd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">httpd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_irqbalance_on:ste:1" comment="irqbalance listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">irqbalance.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_kdump_off:ste:1" comment="kdump is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">kdump.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_mdmonitor_off:ste:1" comment="mdmonitor is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">mdmonitor.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_messagebus_off:ste:1" comment="messagebus is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">messagebus.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_named_off:ste:1" comment="named is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">named.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_netconsole_off:ste:1" comment="netconsole is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">netconsole.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_nfs_off:ste:1" comment="nfs is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">nfs.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_nfslock_off:ste:1" comment="nfslock is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">nfslock.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntpd_on:ste:1" comment="ntpd listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">ntpd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntpdate_off:ste:1" comment="ntpdate is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">ntpdate.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_oddjobd_off:ste:1" comment="oddjobd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">oddjobd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_portreserve_off:ste:1" comment="portreserve is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">portreserve.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_postfix_on:ste:1" comment="postfix listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">postfix.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_psacct_on:ste:1" comment="psacct listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">psacct.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_qpidd_off:ste:1" comment="qpidd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">qpidd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_quota_nld_off:ste:1" comment="quota_nld is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">quota_nld.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rdisc_off:ste:1" comment="rdisc is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">rdisc.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rexec_off:ste:1" comment="rexec is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">rexec.socket</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rhnsd_off:ste:1" comment="rhnsd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">rhnsd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rhsmcertd_off:ste:1" comment="rhsmcertd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">rhsmcertd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rlogin_off:ste:1" comment="rlogin is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">rlogin.socket</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rpcbind_off:ste:1" comment="rpcbind is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">rpcbind.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rpcgssd_off:ste:1" comment="rpcgssd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">rpcgssd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rpcidmapd_off:ste:1" comment="rpcidmapd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">rpcidmapd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rpcsvcgssd_off:ste:1" comment="rpcsvcgssd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">rpcsvcgssd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rsh_off:ste:1" comment="rsh is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">rsh.socket</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_on:ste:1" comment="rsyslog listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">rsyslog.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_saslauthd_off:ste:1" comment="saslauthd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">saslauthd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_smartd_off:ste:1" comment="smartd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">smartd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_smb_off:ste:1" comment="smb is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">smb.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_snmpd_off:ste:1" comment="snmpd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">snmpd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_squid_off:ste:1" comment="squid is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">squid.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_sshd_on:ste:1" comment="sshd listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">sshd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_sssd_off:ste:1" comment="sssd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">sssd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_sssd_on:ste:1" comment="sssd listed at least once in the dependencies" version="1">
      <linux:dependency entity_check="at least one">sssd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_sysstat_off:ste:1" comment="sysstat is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">sysstat.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_telnet_off:ste:1" comment="telnet is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">telnet.socket</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_tftp_off:ste:1" comment="tftp is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">tftp.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_vsftpd_off:ste:1" comment="vsftpd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">vsftpd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_xinetd_off:ste:1" comment="xinetd is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">xinetd.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ypbind_off:ste:1" comment="ypbind is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">ypbind.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <linux:systemdunitdependency_state id="oval:ssg-state_systemd_zebra_off:ste:1" comment="zebra is not listed in the dependencies" version="1">
      <linux:dependency entity_check="none satisfy">zebra.service</linux:dependency>
    </linux:systemdunitdependency_state>
    <ind:textfilecontent54_state id="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*ocsp_on.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:symlink_state comment="Disable Ctrl-Alt-Del key sequence override exists" id="oval:ssg-state_disable_ctrlaltdel_exists:ste:1" version="1">
      <unix:filepath>/etc/systemd/system/ctrl-alt-del.target</unix:filepath>
      <unix:canonical_path>/dev/null</unix:canonical_path>
    </unix:symlink_state>
    <unix:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_rsyslog_files_permissions:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:symlink_state comment="default.target is linked to multi-user.target" id="oval:ssg-state_disable_xwindows_runlevel:ste:1" version="1">
      <unix:filepath>/etc/systemd/system/default.target</unix:filepath>
      <unix:canonical_path operation="pattern match">/lib/systemd/system/multi-user.target$</unix:canonical_path>
    </unix:symlink_state>
    <ind:textfilecontent54_state id="oval:ssg-state_accounts_logon_fail_delay:ste:1" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_accounts_fail_delay:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <unix:file_state id="oval:ssg-state_groupowner_cron_allow_file:ste:1" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_etc_cron_allow_uid_root:ste:1" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_sshd_private_key:ste:1" version="1">
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_sshd_pub_key:ste:1" version="1">
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid:ste:1" version="1">
      <unix:sgid datatype="boolean">true</unix:sgid>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_sgid_whitelist:ste:1" version="1">
      <unix:filepath var_ref="oval:ssg-var_sgid_whitelist:var:1" var_check="at least one"/>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_suid:ste:1" version="1">
      <unix:suid datatype="boolean">true</unix:suid>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_suid_whitelist:ste:1" version="1">
      <unix:filepath var_ref="oval:ssg-var_suid_whitelist:var:1" var_check="at least one"/>
    </unix:file_state>
    <ind:textfilecontent54_state id="oval:ssg-state_grub2_enable_fips_mode:ste:1" version="1">
      <ind:subexpression datatype="string" operation="pattern match">^.*fips=1.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_remote_filesystem_krb_sec:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*sec=krb5:krb5i:krb5p.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:runlevel_state comment="configured to start" id="oval:ssg-state_service_nails_on:ste:1" version="1">
      <unix:start datatype="boolean">true</unix:start>
      <unix:kill datatype="boolean">false</unix:kill>
    </unix:runlevel_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_fs_suid_dumpable:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_log_martians:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_rp_filter:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_all_send_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_log_martians:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_rp_filter:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_conf_default_send_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_ip_forward:ste:1" version="1">
      <unix:value datatype="int" operation="equals">0</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv4_tcp_syncookies:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_ra:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_accept_source_route:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_forwarding:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_ra:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1"/>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_default_accept_source_route:ste:1" version="1">
      <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_value:var:1"/>
    </unix:sysctl_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_source_route:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_forwarding:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_source_route:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_value:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_use_kerberos_security_all_exports:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*,sec=krb5\:krb5i\:krb5p.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive:ste:1" version="1">
      <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_account_disable_post_pw_expiration:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1" version="1">
      <ind:subexpression operation="greater than" datatype="int">-1</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1" version="1">
      <ind:value var_ref="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" operation="equals" var_check="at least one"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_maxlogins:ste:1" version="1">
      <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-state_last_pass_max_days_instance_value:ste:1" version="1">
      <ind:value operation="less than or equal" var_ref="oval:ssg-var_accounts_maximum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_last_pass_min_days_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_minimum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <unix:password_state id="oval:ssg-state_accounts_password_all_shadowed:ste:1" version="1">
      <unix:password>x</unix:password>
    </unix:password_state>
    <ind:variable_state id="oval:ssg-state_last_pass_min_len_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_minlen_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_pwquality_dcredit:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_dcredit:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_pwquality_difok:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_difok:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_pwquality_lcredit:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_lcredit:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_pwquality_maxclassrepeat:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_maxclassrepeat:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_pwquality_maxrepeat:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_maxrepeat:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_pwquality_minclass:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_minclass:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_pwquality_minlen:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_minlen:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_pwquality_ocredit:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_ocredit:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_retry:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_retry:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_password_pam_pwquality_ucredit:ste:1" version="1">
      <ind:instance datatype="int">1</ind:instance>
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_ucredit:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_unix_remember:ste:1" version="1">
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_unix_remember:var:1"/>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-state_last_pass_warn_age_instance_value:ste:1" version="1">
      <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" datatype="int" var_check="at least one"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1" version="2">
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1" version="2">
      <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_system-auth:ste:1" version="2">
      <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_unlock_time_password-auth:ste:1" version="2">
      <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1"/>
    </ind:textfilecontent54_state>
    <unix:file_state comment="group or other has write privilege" id="oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1" version="1" operator="OR">
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state comment="symbolic link" id="oval:ssg-state_accounts_root_path_dirs_symlink:ste:1" version="1">
      <unix:type operation="equals">symbolic link</unix:type>
    </unix:file_state>
    <ind:textfilecontent54_state id="oval:ssg-state_etc_profile_tmout:ste:1" version="1">
      <ind:subexpression datatype="int" operation="greater than or equal" var_check="all" var_ref="oval:ssg-var_accounts_tmout:var:1"/>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_bashrc:ste:1" version="1">
      <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_csh_cshrc:ste:1" version="1">
      <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1" version="1">
      <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_profile:ste:1" version="1">
      <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_aide_use_fips_hashes:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*sha512.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_aide_verify_acls:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*acl.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_aide_verify_ext_attributes:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*xattrs.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:file_state id="oval:ssg-state_setuid_or_setgid_set:ste:1" version="1" operator="OR">
      <unix:suid datatype="boolean">true</unix:suid>
      <unix:sgid datatype="boolean">true</unix:sgid>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_dev_proc_sys_dirs:ste:1" version="1">
      <unix:filepath operation="pattern match">^\/(dev|proc|sys)\/.*$</unix:filepath>
    </unix:file_state>
    <ind:textfilecontent54_state id="oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1" version="1">
      <ind:subexpression operation="not equal" datatype="string" var_ref="oval:ssg-variable_full_form_of_audit_rule:var:1" var_check="all"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_audit_rules_privileged_commands:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string" var_ref="oval:ssg-variable_full_form_of_audit_rule:var:1" var_check="at least one"/>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-state_count_of_privileged_commands_having_audit_definition_augenrules:ste:1" version="1">
      <ind:value operation="equals" datatype="int" var_ref="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_augenrules:var:1" var_check="at least one"/>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_count_of_privileged_commands_having_audit_definition_auditctl:ste:1" version="1">
      <ind:value operation="equals" datatype="int" var_ref="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_auditctl:var:1" var_check="at least one"/>
    </ind:variable_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-var_auditd_action_mail_acct:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1" version="1">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_admin_space_left_action:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_flush:ste:1" version="1">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_flush:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file:ste:1" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_max_log_file:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1" version="1">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_max_log_file_action:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_num_logs:ste:1" version="1">
      <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_num_logs:var:1" datatype="int"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_action:ste:1" version="2">
      <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_space_left_action:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_bootloader_audit_argument:ste:1" version="1">
      <ind:subexpression datatype="string" operation="pattern match">^.*audit=1.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_bootloader_disable_recovery_argument:ste:1" version="1">
      <ind:subexpression datatype="string" operation="pattern match">^true|"true"$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_bootloader_nousb_argument:ste:1" version="1">
      <ind:subexpression datatype="string" operation="pattern match">^.*nousb.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_gdm_login_banner_text_setting:ste:1" version="1">
      <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-login_banner_text:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_screensaver_idle_delay_setting:ste:1" version="1">
      <ind:subexpression datatype="int" operation="equals" var_check="all" var_ref="oval:ssg-inactivity_timeout_value:var:1"/>
    </ind:textfilecontent54_state>
    <unix:file_state id="oval:ssg-state_dir_perms_etc_httpd_conf:ste:1" operator="AND" version="2">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_dir_perms_var_log_httpd:ste:1" version="2">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_world_writable_and_not_sticky:ste:1" version="1">
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state comment="uid greater than or equal to 1000 and world writable" id="oval:ssg-state_gid_is_user_and_world_writable:ste:1" version="1">
      <unix:user_id datatype="int" operation="greater than or equal">1000</unix:user_id>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <ind:textfilecontent54_state id="oval:ssg-state_core_dumps_limitsconf:ste:1" version="1">
      <ind:subexpression operation="equals">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_another_rotate_interval_after_daily:ste:1" version="1">
      <!-- if some of (weekly / monthly / yearly) uncommented setting is found
         (in the previously selected chunk of text) in one of the following
         parts:
         * before the first '{' character,
         * somewhere after '}' character and before another '{' character,
         * after final '}' character and before end of the chunk
         exclude such object from the found ones (since in that case earlier
         daily setting would be replaced with the found setting) -->
      <ind:subexpression datatype="string" operation="pattern match">}[^{]+[\n][\s]*(weekly|monthly|yearly)|[\n][\s]*(weekly|monthly|yearly)[^}]+{</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-fd431d51-4ae0493b:ste:1" version="1">
      <linux:release>4ae0493b</linux:release>
      <linux:version>fd431d51</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-2fa658e0-45700c69:ste:1" version="1">
      <linux:release>45700c69</linux:release>
      <linux:version>2fa658e0</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-f4a80eb5-53a7ff4b:ste:1" version="1">
      <linux:release>53a7ff4b</linux:release>
      <linux:version>f4a80eb5</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-c105b9de-4e0fd3a3:ste:1" version="1">
      <linux:release>4e0fd3a3</linux:release>
      <linux:version>c105b9de</linux:version>
    </linux:rpminfo_state>
    <unix:file_state id="oval:ssg-state_file_group_owner_grub2_cfg:ste:1" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_groupowner_etc_group:ste:1" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_groupowner_etc_gshadow:ste:1" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_groupowner_etc_passwd:ste:1" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_owner_etc_group:ste:1" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_owner_etc_gshadow:ste:1" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_owner_etc_passwd:ste:1" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_binaries_not_root:ste:1" version="1" operator="OR">
      <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_libraries_not_root:ste:1" version="1">
      <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_not_root_root_var_log_audit:ste:1" version="1" operator="OR">
      <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
      <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1" version="1" operator="OR">
      <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_perms_binary_files_symlink:ste:1" version="1">
      <unix:type operation="equals">symbolic link</unix:type>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_etc_group:ste:1" version="2">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_gid_0:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_gshadow_state_mode_0000:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">false</unix:uread>
      <unix:uwrite datatype="boolean">false</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_gid_0:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_passwd_state_mode_0644_or_stronger:ste:1" version="2">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_uid_0:ste:1" version="1">
      <unix:user_id datatype="int" operation="equals">0</unix:user_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_gid_0:ste:1" version="1">
      <unix:group_id datatype="int" operation="equals">0</unix:group_id>
    </unix:file_state>
    <unix:file_state id="oval:ssg-_etc_shadow_state_mode_0000:ste:1" version="1">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uread datatype="boolean">false</unix:uread>
      <unix:uwrite datatype="boolean">false</unix:uwrite>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_grub2_cfg:ste:1" version="1">
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gread datatype="boolean">false</unix:gread>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_home_dirs_home_itself:ste:1" version="1">
      <!-- Exclude /home directory itself from the check. Check /home/* directories only. -->
      <unix:path operation="equals">/home</unix:path>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_home_dirs_wrong_perm:ste:1" version="1" operator="OR">
      <unix:suid datatype="boolean">true</unix:suid>
      <unix:sgid datatype="boolean">true</unix:sgid>
      <unix:sticky datatype="boolean">true</unix:sticky>
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">true</unix:owrite>
      <unix:oexec datatype="boolean">true</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_wrong_file_permissions_httpd_server_conf_files:ste:1" version="2" operator="AND">
      <unix:suid datatype="boolean">false</unix:suid>
      <unix:sgid datatype="boolean">false</unix:sgid>
      <unix:sticky datatype="boolean">false</unix:sticky>
      <unix:uexec datatype="boolean">false</unix:uexec>
      <unix:gwrite datatype="boolean">false</unix:gwrite>
      <unix:gexec datatype="boolean">false</unix:gexec>
      <unix:oread datatype="boolean">false</unix:oread>
      <unix:owrite datatype="boolean">false</unix:owrite>
      <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state id="oval:ssg-perms_state_symlink:ste:1" version="1">
      <unix:type operation="equals">symbolic link</unix:type>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write:ste:1" version="1">
      <unix:type operation="equals">regular</unix:type>
      <unix:owrite datatype="boolean">true</unix:owrite>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1" version="1">
      <unix:filepath operation="pattern match">^/selinux/(?:(?:member)|(?:user)|(?:relabel)|(?:create)|(?:access)|(?:context))$</unix:filepath>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1" version="1">
      <unix:filepath operation="pattern match">^/proc/.*$</unix:filepath>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1" version="1">
      <unix:filepath operation="pattern match">^/sys/.*$</unix:filepath>
    </unix:file_state>
    <unix:file_state comment="Files that are owned by a group." id="oval:ssg-state_file_permissions_ungroupowned:ste:1" version="1">
      <unix:group_id datatype="int" var_ref="oval:ssg-variable_file_permissions_ungroupowned:var:1" var_check="at least one"/>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_not_mode_0600:ste:1" version="1" operator="OR">
      <!-- if any one of these is true then mode is NOT 0640 (hence the OR operator) -->
      <unix:suid datatype="boolean">true</unix:suid>
      <unix:sgid datatype="boolean">true</unix:sgid>
      <unix:sticky datatype="boolean">true</unix:sticky>
      <unix:uexec datatype="boolean">true</unix:uexec>
      <unix:gread datatype="boolean">true</unix:gread>
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:gexec datatype="boolean">true</unix:gexec>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">true</unix:owrite>
      <unix:oexec datatype="boolean">true</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_not_mode_0640:ste:1" version="1" operator="OR">
      <!-- if any one of these is true then mode is NOT 0640 (hence the OR operator) -->
      <unix:suid datatype="boolean">true</unix:suid>
      <unix:sgid datatype="boolean">true</unix:sgid>
      <unix:sticky datatype="boolean">true</unix:sticky>
      <unix:uexec datatype="boolean">true</unix:uexec>
      <unix:gwrite datatype="boolean">true</unix:gwrite>
      <unix:gexec datatype="boolean">true</unix:gexec>
      <unix:oread datatype="boolean">true</unix:oread>
      <unix:owrite datatype="boolean">true</unix:owrite>
      <unix:oexec datatype="boolean">true</unix:oexec>
    </unix:file_state>
    <unix:file_state id="oval:ssg-state_file_user_owner_grub2_cfg:ste:1" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <ind:textfilecontent54_state comment="port ssh is listening" id="oval:ssg-state_sshd_listening_port:ste:1" version="1">
      <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-sshd_listening_port:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_gid_passwd_group_same:ste:1" version="1">
      <ind:subexpression operation="equals" var_ref="oval:ssg-var_gid_passwd_group_same:var:1" var_check="at least one" datatype="string"/>
    </ind:textfilecontent54_state>
    <unix:file_state id="oval:ssg-state_groupowner_shadow_file:ste:1" version="1">
      <unix:group_id datatype="int">0</unix:group_id>
    </unix:file_state>
    <linux:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_workstation:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_server:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel_computenode:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
      <linux:version operation="pattern match">^6.*$</linux:version>
    </linux:rpminfo_state>
    <linux:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
      <linux:version operation="pattern match">^7.*$</linux:version>
    </linux:rpminfo_state>
    <ind:family_state id="oval:ssg-state_unix_wrlinux:ste:1" version="1">
      <ind:family>unix</ind:family>
    </ind:family_state>
    <linux:partition_state id="oval:ssg-state_dev_shm_nodev:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
    </linux:partition_state>
    <linux:partition_state id="oval:ssg-state_dev_shm_noexec:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
    </linux:partition_state>
    <linux:partition_state id="oval:ssg-state_dev_shm_nosuid:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
    </linux:partition_state>
    <linux:partition_state id="oval:ssg-state_local_nodev:ste:1" version="1">
      <!-- this check defines a local partition as one which has a device node in /dev -->
      <linux:device operation="pattern match">^/dev/.*$</linux:device>
      <linux:mount_options datatype="string" entity_check="all" operation="not equal">nodev</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_remote_filesystem_nodev:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*nodev.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?nodev,?.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_nodev_runtime_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?nodev,?.*</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_nodev_runtime_not_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?noexec,?.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_noexec_runtime_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?noexec,?.*</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_noexec_runtime_not_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_remote_filesystem_nosuid:ste:1" version="1">
      <ind:subexpression operation="pattern match">^.*nosuid.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?nosuid,?.*$</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_nosuid_runtime_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
      <ind:subexpression operation="pattern match" datatype="string">^.*,?nosuid,?.*</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_nosuid_runtime_not_cd_dvd_drive:ste:1" version="1">
      <linux:device datatype="string" operation="equals" var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
    </linux:partition_state>
    <ind:textfilecontent54_state id="oval:ssg-state_20340112:ste:1" version="1">
      <ind:instance datatype="int">2</ind:instance>
      <ind:subexpression operation="pattern match">sec=(krb5i|ntlmv2i)</ind:subexpression>
    </ind:textfilecontent54_state>
    <linux:partition_state id="oval:ssg-state_tmp_nodev:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
    </linux:partition_state>
    <linux:partition_state id="oval:ssg-state_tmp_noexec:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
    </linux:partition_state>
    <linux:partition_state id="oval:ssg-state_tmp_nosuid:ste:1" version="1">
      <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
    </linux:partition_state>
    <unix:interface_state id="oval:ssg-state_promisc:ste:1" version="1">
      <unix:flag datatype="string" entity_check="at least one" operation="equals">PROMISC</unix:flag>
    </unix:interface_state>
    <unix:file_state id="oval:ssg-file_permissions_unowned_userid_list_match:ste:1" version="1">
      <unix:user_id var_check="at least one" var_ref="oval:ssg-file_permissions_unowned_userid_list:var:1" datatype="int"/>
    </unix:file_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_default_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_reserved_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:variable_state id="oval:ssg-state_shell_defined_dynalloc_uid_range:ste:1" version="1">
      <ind:value datatype="int" operation="greater than">0</ind:value>
    </ind:variable_state>
    <ind:environmentvariable58_state comment="starts with colon or period" id="oval:ssg-state_begins_colon_period:ste:1" version="1">
      <ind:value operation="pattern match">^[:\.]</ind:value>
    </ind:environmentvariable58_state>
    <ind:environmentvariable58_state comment="colon twice in a row" id="oval:ssg-state_contains_double_colon:ste:1" version="1">
      <ind:value operation="pattern match">::</ind:value>
    </ind:environmentvariable58_state>
    <ind:environmentvariable58_state comment="period twice in a row" id="oval:ssg-state_contains_double_period:ste:1" version="1">
      <ind:value operation="pattern match">\.\.</ind:value>
    </ind:environmentvariable58_state>
    <ind:environmentvariable58_state comment="ends with colon or period" id="oval:ssg-state_ends_colon_period:ste:1" version="1">
      <ind:value operation="pattern match">[:\.]$</ind:value>
    </ind:environmentvariable58_state>
    <ind:environmentvariable58_state comment="begins with a slash" id="oval:ssg-state_begins_slash:ste:1" version="1">
      <ind:value operation="pattern match">^[^/]</ind:value>
    </ind:environmentvariable58_state>
    <ind:environmentvariable58_state comment="elements begin with a slash" id="oval:ssg-state_contains_relative_path:ste:1" version="1">
      <ind:value operation="pattern match">[^\\]:[^/]</ind:value>
    </ind:environmentvariable58_state>
    <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_md5_hash:ste:1" version="1" operator="AND">
      <linux:md5_differs>fail</linux:md5_differs>
      <!-- <linux:configuration_file datatype="boolean">false</linux:configuration_file> -->
      <!-- <linux:documentation_file datatype="boolean">false</linux:documentation_file> -->
      <!-- <linux:ghost_file datatype="boolean">false</linux:ghost_file> -->
      <!-- <linux:license_file datatype="boolean">false</linux:license_file> -->
      <!-- <linux:readme_file datatype="boolean">false</linux:readme_file> -->
    </linux:rpmverifyfile_state>
    <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_user_ownership:ste:1" version="1">
      <linux:ownership_differs>fail</linux:ownership_differs>
    </linux:rpmverifyfile_state>
    <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_group_ownership:ste:1" version="1">
      <linux:group_differs>fail</linux:group_differs>
    </linux:rpmverifyfile_state>
    <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_mode:ste:1" version="1">
      <linux:mode_differs>fail</linux:mode_differs>
    </linux:rpmverifyfile_state>
    <linux:selinuxsecuritycontext_state comment="do it" id="oval:ssg-state_selinux_all_devicefiles_labeled:ste:1" version="1">
      <linux:type datatype="string" operation="equals">device_t</linux:type>
    </linux:selinuxsecuritycontext_state>
    <linux:selinuxsecuritycontext_state comment="do it" id="oval:ssg-state_selinux_confinement_of_daemons:ste:1" version="1">
      <linux:type datatype="string" operation="equals">initrc_t</linux:type>
    </linux:selinuxsecuritycontext_state>
    <ind:textfilecontent54_state id="oval:ssg-state_selinux_policy:ste:1" version="1">
      <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_selinux_policy_name:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_etc_selinux_config:ste:1" version="1">
      <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_selinux_state:var:1"/>
    </ind:textfilecontent54_state>
    <ind:variable_state id="oval:ssg-state_last_encrypt_method_instance_value:ste:1" version="1">
      <ind:value operation="equals" datatype="string">SHA512</ind:value>
    </ind:variable_state>
    <ind:textfilecontent54_state comment="upper bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_upper_bound:ste:1" version="1">
      <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-sshd_idle_timeout_value:var:1"/>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state comment="lower bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_lower_bound:ste:1" version="1">
      <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_sshd_clientalivecountmax:ste:1" version="1">
      <ind:subexpression datatype="int" operation="equals">0</ind:subexpression>
    </ind:textfilecontent54_state>
    <ind:textfilecontent54_state id="oval:ssg-state_sysconfig_networking_bootproto_ifcfg:ste:1" version="2">
      <ind:subexpression operation="pattern match">^(static|none)$</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_exec_shield:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_runtime_kernel_dmesg_restrict:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_randomize_va_space:ste:1" version="1">
      <unix:value datatype="int" operation="equals">2</unix:value>
    </unix:sysctl_state>
    <unix:sysctl_state id="oval:ssg-state_sysctl_net_ipv6_conf_all_disable_ipv6:ste:1" version="1">
      <unix:value datatype="int" operation="equals">1</unix:value>
    </unix:sysctl_state>
    <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_kernel_dmesg_restrict:ste:1" version="1">
      <ind:subexpression operation="equals" datatype="int">1</ind:subexpression>
    </ind:textfilecontent54_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppc_64:ste:1" version="1">
      <unix:processor_type operation="equals">ppc64</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1">
      <unix:processor_type operation="equals">ppc64le</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="32 bit architecture" id="oval:ssg-state_system_info_architecture_x86:ste:1" version="1">
      <unix:processor_type operation="equals">i686</unix:processor_type>
    </unix:uname_state>
    <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_x86_64:ste:1" version="1">
      <unix:processor_type operation="equals">x86_64</unix:processor_type>
    </unix:uname_state>
    <ind:variable_state id="oval:ssg-ste_umask_for_daemons:ste:1" version="1">
      <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_umask_for_daemons_umask_as_number:var:1"/>
    </ind:variable_state>
    <unix:file_state id="oval:ssg-state_etc_shadow_uid_root:ste:1" version="1">
      <unix:user_id datatype="int">0</unix:user_id>
    </unix:file_state>
    <ind:variable_state id="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1" version="1">
      <ind:value operation="equals">/dev/cdrom</ind:value>
    </ind:variable_state>
  </states>
  <variables>
    <constant_variable id="oval:ssg-var_configuration_files_storage:var:1" version="1" comment="Docker storage configuration files" datatype="string">
      <value>/etc/sysconfig/docker-storage</value>
      <value>/usr/lib/docker-storage-setup/docker-storage-setup</value>
    </constant_variable>
    <local_variable id="oval:ssg-var_storage_device:var:1" version="1" comment="File specified in --storage-opt dm.thinpooldev" datatype="string">
      <object_component object_ref="oval:ssg-obj_storage_device_path:obj:1" item_field="subexpression"/>
    </local_variable>
    <local_variable id="oval:ssg-variable_smart_card_enabled_system_auth:var:1" datatype="string" comment="Regular expression to check if smartcard authentication is enabled in /etc/pam.d/system-auth" version="1">
      <concat>
        <literal_component>\nauth[\s]+required[\s]+pam_env.so</literal_component>
        <literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</literal_component>
        <literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</literal_component>
        <literal_component>\nauth[\s]+\[success=done[\s]authinfo_unavail=ignore[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
        <literal_component>pam_pkcs11.so[\s]nodebug\n</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_smart_card_required_system_auth:var:1" datatype="string" comment="Regular expressiion to check if smartcard authentication is required in /etc/pam.d/system-auth" version="1">
      <concat>
        <literal_component>\nauth[\s]+required[\s]+pam_env.so</literal_component>
        <literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</literal_component>
        <literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</literal_component>
        <literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
        <literal_component>pam_pkcs11.so[\s]nodebug[\s]wait_for_card\n</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" datatype="string" comment="Regular expression to check if smartcard authentication is required in /etc/pam.d/smartcard-auth" version="1">
      <concat>
        <literal_component>\nauth[\s]+required[\s]+pam_env.so</literal_component>
        <literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
        <literal_component>pam_pkcs11.so[\s]nodebug[\s]wait_for_card\n.*</literal_component>
        <literal_component>\npassword[\s]+required[\s]+pam_pkcs11.so\n</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfg_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfg_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfg_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_log_files_paths:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfo_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfo_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfo_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_log_files_paths:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
      <glob_to_regex>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1"/>
      </glob_to_regex>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_all_log_files_as_string:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files concatenated into string">
      <concat>
        <variable_component var_ref="oval:ssg-var_rfp_include_config_regex:var:1"/>
        <literal_component datatype="string">%/etc/rsyslog.conf</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_all_log_files_as_collection:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
      <split delimiter="%">
        <variable_component var_ref="oval:ssg-var_rfp_all_log_files_as_string:var:1"/>
      </split>
    </local_variable>
    <local_variable id="oval:ssg-var_rfp_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_log_files_paths:obj:1"/>
    </local_variable>
    <external_variable id="oval:ssg-var_accounts_fail_delay:var:1" datatype="int" version="1" comment="Expected fail_delay"/>
    <constant_variable id="oval:ssg-var_sgid_whitelist:var:1" version="1" datatype="string" comment="sgid whitelist">
      <value>/usr/bin/cgclassify</value>
      <value>/usr/bin/cgexec</value>
      <value>/usr/sbin/netreport</value>
      <value>/usr/bin/crontab</value>
      <value>/usr/bin/gnomine</value>
      <value>/usr/bin/iagno</value>
      <value>/usr/bin/locate</value>
      <value>/usr/bin/lockfile</value>
      <value>/usr/bin/same-gnome</value>
      <value>/usr/bin/screen</value>
      <value>/usr/bin/ssh-agent</value>
      <value>/usr/bin/wall</value>
      <value>/usr/bin/write</value>
      <value>/usr/lib/vte/gnome-pty-helper</value>
      <value>/usr/lib/vte-2.90/gnome-pty-helper</value>
      <value>/usr/lib/vte-2.91/gnome-pty-helper</value>
      <value>/usr/lib64/vte/gnome-pty-helper</value>
      <value>/usr/lib64/vte-2.90/gnome-pty-helper</value>
      <value>/usr/lib64/vte-2.91/gnome-pty-helper</value>
      <value>/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache</value>
      <value>/usr/libexec/kde4/kdesud</value>
      <value>/usr/libexec/openssh/ssh-keysign</value>
      <value>/usr/libexec/utempter/utempter</value>
      <value>/usr/lib/mailman/cgi-bin/admindb</value>
      <value>/usr/lib/mailman/cgi-bin/admin</value>
      <value>/usr/lib/mailman/cgi-bin/confirm</value>
      <value>/usr/lib/mailman/cgi-bin/create</value>
      <value>/usr/lib/mailman/cgi-bin/edithtml</value>
      <value>/usr/lib/mailman/cgi-bin/listinfo</value>
      <value>/usr/lib/mailman/cgi-bin/options</value>
      <value>/usr/lib/mailman/cgi-bin/private</value>
      <value>/usr/lib/mailman/cgi-bin/rmlist</value>
      <value>/usr/lib/mailman/cgi-bin/roster</value>
      <value>/usr/lib/mailman/cgi-bin/subscribe</value>
      <value>/usr/lib/mailman/mail/mailman</value>
      <value>/usr/sbin/lockdev</value>
      <value>/usr/sbin/postdrop</value>
      <value>/usr/sbin/postqueue</value>
      <value>/usr/sbin/sendmail.sendmail</value>
    </constant_variable>
    <constant_variable id="oval:ssg-var_suid_whitelist:var:1" version="1" datatype="string" comment="suid whitelist">
      <value>/usr/bin/abrt-action-install-debuginfo-to-abrt-cache</value>
      <value>/usr/bin/at</value>
      <value>/usr/bin/chage</value>
      <value>/usr/bin/chfn</value>
      <value>/usr/bin/chsh</value>
      <value>/usr/bin/crontab</value>
      <value>/usr/bin/fusermount</value>
      <value>/usr/bin/gpasswd</value>
      <value>/usr/bin/ksu</value>
      <value>/usr/bin/mount</value>
      <value>/usr/bin/newgrp</value>
      <value>/usr/bin/passwd</value>
      <value>/usr/bin/pkexec</value>
      <value>/usr/bin/staprun</value>
      <value>/usr/bin/sudoedit</value>
      <value>/usr/bin/sudo</value>
      <value>/usr/bin/su</value>
      <value>/usr/bin/umount</value>
      <value>/usr/bin/Xorg</value>
      <value>/usr/lib64/amanda/application/amgtar</value>
      <value>/usr/lib64/amanda/application/amstar</value>
      <value>/usr/lib64/amanda/calcsize</value>
      <value>/usr/lib64/amanda/dumper</value>
      <value>/usr/lib64/amanda/killpgrp</value>
      <value>/usr/lib64/amanda/planner</value>
      <value>/usr/lib64/amanda/rundump</value>
      <value>/usr/lib64/amanda/runtar</value>
      <value>/usr/lib64/dbus-1/dbus-daemon-launch-helper</value>
      <value>/usr/lib/amanda/application/amgtar</value>
      <value>/usr/lib/amanda/application/amstar</value>
      <value>/usr/lib/amanda/calcsize</value>
      <value>/usr/lib/amanda/dumper</value>
      <value>/usr/lib/amanda/killpgrp</value>
      <value>/usr/lib/amanda/planner</value>
      <value>/usr/lib/amanda/rundump</value>
      <value>/usr/lib/amanda/runtar</value>
      <value>/usr/lib/dbus-1/dbus-daemon-launch-helper</value>
      <value>/usr/libexec/abrt-action-install-debuginfo-to-abrt-cache</value>
      <value>/usr/libexec/kde4/kpac_dhcp_helper</value>
      <value>/usr/libexec/qemu-bridge-helper</value>
      <value>/usr/libexec/spice-gtk-x86_64/spice-client-glib-usb-acl-helper</value>
      <value>/usr/libexec/sssd/krb5_child</value>
      <value>/usr/libexec/sssd/ldap_child</value>
      <value>/usr/libexec/sssd/proxy_child</value>
      <value>/usr/libexec/sssd/selinux_child</value>
      <value>/usr/lib/polkit-1/polkit-agent-helper-1</value>
      <value>/usr/sbin/amcheck</value>
      <value>/usr/sbin/amservice</value>
      <value>/usr/sbin/mount.nfs</value>
      <value>/usr/sbin/pam_timestamp_check</value>
      <value>/usr/sbin/unix_chkpwd</value>
      <value>/usr/sbin/userhelper</value>
      <value>/usr/sbin/usernetctl</value>
    </constant_variable>
    <external_variable comment="External variable for net.ipv4.conf.all.accept_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.all.accept_source_route" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.all.log_martians" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.all.rp_filter" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.all.secure_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.default.accept_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.default.accept_source_route" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.default.log_martians" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.default.rp_filter" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.conf.default.secure_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.icmp_echo_ignore_broadcasts" datatype="int" id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.icmp_ignore_bogus_error_responses" datatype="int" id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv4.tcp_syncookies" datatype="int" id="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.all.accept_ra" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.all.accept_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.all.accept_source_route" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.all.forwarding" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_forwarding_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.default.accept_ra" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.default.accept_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" version="1"/>
    <external_variable comment="External variable for net.ipv6.conf.default.accept_source_route" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route_value:var:1" version="1"/>
    <external_variable comment="inactive days expiration" datatype="int" id="oval:ssg-var_account_disable_post_pw_expiration:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of all username rows retrieved from /etc/passwd (including duplicates if any)">
      <count>
        <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
      </count>
    </local_variable>
    <local_variable id="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of unique username rows retrieved from /etc/passwd">
      <count>
        <unique>
          <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
        </unique>
      </count>
    </local_variable>
    <external_variable comment="maximum number of concurrent logins per user" datatype="int" id="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_max_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MAX_DAYS directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MAX_DAYS\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Maximum password age" datatype="int" id="oval:ssg-var_accounts_maximum_age_login_defs:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_min_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_DAYS directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MIN_DAYS\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Minimum password age in days" datatype="int" id="oval:ssg-var_accounts_minimum_age_login_defs:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_min_len_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_LEN directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_MIN_LEN\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="Password minimum length" datatype="int" id="oval:ssg-var_accounts_password_minlen_login_defs:var:1" version="1"/>
    <external_variable comment="External variable for pam_pwquality dcredit" datatype="int" id="oval:ssg-var_password_pam_dcredit:var:1" version="1"/>
    <external_variable comment="External variable for pam_pwquality difok" datatype="int" id="oval:ssg-var_password_pam_difok:var:1" version="1"/>
    <external_variable comment="External variable for pam_pwquality lcredit" datatype="int" id="oval:ssg-var_password_pam_lcredit:var:1" version="1"/>
    <external_variable comment="External variable for pam_pwquality maxclassrepeat" datatype="int" id="oval:ssg-var_password_pam_maxclassrepeat:var:1" version="1"/>
    <external_variable comment="External variable for pam_pwquality maxrepeat" datatype="int" id="oval:ssg-var_password_pam_maxrepeat:var:1" version="1"/>
    <external_variable comment="External variable for pam_pwquality minclass" datatype="int" id="oval:ssg-var_password_pam_minclass:var:1" version="1"/>
    <external_variable comment="External variable for pam_pwquality minlen" datatype="int" id="oval:ssg-var_password_pam_minlen:var:1" version="1"/>
    <external_variable comment="External variable for pam_pwquality ocredit" datatype="int" id="oval:ssg-var_password_pam_ocredit:var:1" version="1"/>
    <external_variable comment="External variable for pam_pwquality retry" datatype="int" id="oval:ssg-var_password_pam_retry:var:1" version="1"/>
    <external_variable comment="External variable for pam_pwquality ucredit" datatype="int" id="oval:ssg-var_password_pam_ucredit:var:1" version="1"/>
    <external_variable comment="number of passwords that should be remembered" datatype="int" id="oval:ssg-var_password_pam_unix_remember:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_pass_warn_age_instance_value:var:1" datatype="int" comment="The value of last PASS_WARN_AGE directive in /etc/login.defs" version="1">
      <regex_capture pattern="PASS_WARN_AGE\s+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="password expiration warning age in days" datatype="int" id="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" version="1"/>
    <external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" datatype="int" comment="number of failed login attempts allowed" version="1"/>
    <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" version="2"/>
    <external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" version="2"/>
    <local_variable comment="Split the PATH on the : delimiter" datatype="string" id="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" version="1">
      <split delimiter=":">
        <object_component item_field="value" object_ref="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1"/>
      </split>
    </local_variable>
    <external_variable comment="external variable for TMOUT" datatype="int" id="oval:ssg-var_accounts_tmout:var:1" version="1"/>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_bashrc:var:1" comment="First octal digit of umask from /etc/bashrc" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_bashrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_bashrc:var:1" comment="Second octal digit of umask from /etc/bashrc" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_bashrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_bashrc:var:1" comment="Third octal digit of umask from /etc/bashrc" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_bashrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_etc_bashrc_umask_as_number:var:1" comment="/etc/bashrc umask converted from string to a number" datatype="int" version="1">
      <arithmetic arithmetic_operation="add">
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">64</literal_component>
          <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_bashrc:var:1"/>
        </arithmetic>
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">8</literal_component>
          <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_bashrc:var:1"/>
        </arithmetic>
        <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_bashrc:var:1"/>
      </arithmetic>
    </local_variable>
    <external_variable id="oval:ssg-var_accounts_user_umask_umask_as_number:var:1" comment="Required umask converted from string to octal number" datatype="int" version="1"/>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_csh_cshrc:var:1" comment="First octal digit of umask from /etc/csh.cshrc" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_csh_cshrc:var:1" comment="Second octal digit of umask from /etc/csh.cshrc" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_csh_cshrc:var:1" comment="Third octal digit of umask from /etc/csh.cshrc" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_csh_cshrc:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_etc_csh_cshrc_umask_as_number:var:1" comment="/etc/csh.cshrc umask converted from string to a number" datatype="int" version="1">
      <arithmetic arithmetic_operation="add">
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">64</literal_component>
          <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_csh_cshrc:var:1"/>
        </arithmetic>
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">8</literal_component>
          <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_csh_cshrc:var:1"/>
        </arithmetic>
        <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_csh_cshrc:var:1"/>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1" comment="First octal digit of umask from /etc/login.defs" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1" comment="Second octal digit of umask from /etc/login.defs" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1" comment="Third octal digit of umask from /etc/login.defs" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_etc_login_defs_umask_as_number:var:1" comment="/etc/login.defs umask converted from string to a number" datatype="int" version="1">
      <arithmetic arithmetic_operation="add">
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">64</literal_component>
          <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1"/>
        </arithmetic>
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">8</literal_component>
          <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1"/>
        </arithmetic>
        <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1"/>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1" comment="First octal digit of umask from /etc/profile" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1" comment="Second octal digit of umask from /etc/profile" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1" comment="Third octal digit of umask from /etc/profile" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_etc_profile_umask_as_number:var:1" comment="/etc/profile umask converted from string to a number" datatype="int" version="1">
      <arithmetic arithmetic_operation="add">
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">64</literal_component>
          <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1"/>
        </arithmetic>
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">8</literal_component>
          <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1"/>
        </arithmetic>
        <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1"/>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" datatype="string" comment="Absolute path of Aide build database file" version="1">
      <concat>
        <object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
        <literal_component>/</literal_component>
        <object_component object_ref="oval:ssg-object_aide_build_new_database_filename:obj:1" item_field="subexpression"/>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_aide_operational_database_absolute_path:var:1" datatype="string" comment="Absolute path of Aide build database file" version="1">
      <concat>
        <object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
        <literal_component>/</literal_component>
        <object_component object_ref="oval:ssg-object_aide_operational_database_filename:obj:1" item_field="subexpression"/>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_full_form_of_audit_rule:var:1" comment="full form of audit rules for privileged commands" datatype="string" version="1">
      <concat>
        <literal_component>-a always,exit -F path=</literal_component>
        <object_component object_ref="oval:ssg-object_system_privileged_commands:obj:1" item_field="filepath"/>
        <literal_component> -F perm=x -F auid&gt;=1000 -F auid!=4294967295 -k privileged</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_count_of_suid_sgid_binaries_on_system:var:1" comment="count of suid / sgid binaries actually present on the system" datatype="int" version="1">
      <count>
        <object_component object_ref="oval:ssg-object_system_privileged_commands:obj:1" item_field="filepath"/>
      </count>
    </local_variable>
    <local_variable id="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_augenrules:var:1" comment="count of suid / sgid binaries having full audit rule definition in some of /etc/audit/rules.d/*.rules files" datatype="int" version="1">
      <count>
        <object_component object_ref="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1" item_field="subexpression"/>
      </count>
    </local_variable>
    <local_variable id="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_auditctl:var:1" comment="count of suid / sgid binaries having full audit rule definition in /etc/audit/audit.rules file" datatype="int" version="1">
      <count>
        <object_component object_ref="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1" item_field="subexpression"/>
      </count>
    </local_variable>
    <external_variable comment="audit action_mail_acct setting" datatype="string" id="oval:ssg-var_auditd_action_mail_acct:var:1" version="1"/>
    <external_variable comment="audit admin_space_left_action setting" datatype="string" id="oval:ssg-var_auditd_admin_space_left_action:var:1" version="1"/>
    <external_variable comment="audit flush setting" datatype="string" id="oval:ssg-var_auditd_flush:var:1" version="1"/>
    <external_variable comment="audit max_log_file settting" datatype="int" id="oval:ssg-var_auditd_max_log_file:var:1" version="1"/>
    <external_variable comment="audit max_log_file_action setting" datatype="string" id="oval:ssg-var_auditd_max_log_file_action:var:1" version="1"/>
    <external_variable comment="audit num_logs settting" datatype="int" id="oval:ssg-var_auditd_num_logs:var:1" version="1"/>
    <external_variable comment="audit space_left_action setting" datatype="string" id="oval:ssg-var_auditd_space_left_action:var:1" version="2"/>
    <external_variable comment="warning banner text variable" datatype="string" id="oval:ssg-login_banner_text:var:1" version="1"/>
    <external_variable comment="inactivity timeout variable" datatype="int" id="oval:ssg-inactivity_timeout_value:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_file_permissions_ungroupowned:var:1" datatype="int" version="1" comment="all GIDs on the target system">
      <object_component object_ref="oval:ssg-etc_group_object:obj:1" item_field="subexpression"/>
    </local_variable>
    <external_variable comment="port ssh is listening" datatype="int" id="oval:ssg-sshd_listening_port:var:1" version="1"/>
    <local_variable id="oval:ssg-var_gid_passwd_group_same:var:1" comment="GIDs from /etc/group" datatype="string" version="1">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_gid_passwd_group_same_var:obj:1"/>
    </local_variable>
    <constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" datatype="string" comment="CD/DVD drive alternative names whitelist" version="1">
      <value>/dev/cdrom</value>
      <value>/dev/dvd</value>
      <value>/dev/scd0</value>
      <value>/dev/sr0</value>
    </constant_variable>
    <local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern:var:1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names" version="1">
      <concat>
        <literal_component>^[\s]*</literal_component>
        <variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1"/>
        <!-- Capture the mount options field (4-th column of /etc/fstab) -->
        <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
      </concat>
    </local_variable>
    <local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern:var:1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive" version="1">
      <concat>
        <literal_component>^[\s]*</literal_component>
        <variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
        <!-- Capture the mount options field (4-th column of /etc/fstab) -->
        <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
      </concat>
    </local_variable>
    <external_variable comment="removable partition" datatype="string" id="oval:ssg-var_removable_partition:var:1" version="1"/>
    <local_variable id="oval:ssg-file_permissions_unowned_userid_list:var:1" comment="List of valid user ids" datatype="int" version="1">
      <object_component item_field="subexpression" object_ref="oval:ssg-file_permissions_unowned_userid_list_object:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-variable_sys_uids_etc_passwd:var:1" datatype="int" comment="UIDs retrieved from /etc/passwd" version="1">
      <object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
    </local_variable>
    <local_variable id="oval:ssg-variable_uid_min_value:var:1" datatype="int" comment="Value of last UID_MIN from /etc/login.defs" version="1">
      <regex_capture pattern="UID_MIN[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_default_range_quad_expr:var:1" datatype="int" comment="Construct (x - 0) * (x - (UID_MIN - 1)) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
        <!-- (x - 0) = x => use just "x" value -->
        <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
        <!-- Get (x - (UID_MIN -1)) result -->
        <arithmetic arithmetic_operation="add">
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get -1 * (UID_MIN - 1) result -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <!-- Get (UID_MIN -1) result -->
            <arithmetic arithmetic_operation="add">
              <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
              <variable_component var_ref="oval:ssg-variable_uid_min_value:var:1"/>
              <literal_component datatype="int">-1</literal_component>
            </arithmetic>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-variable_sys_uid_min_value:var:1" datatype="int" comment="Value of last SYS_UID_MIN from /etc/login.defs" version="1">
      <regex_capture pattern="SYS_UID_MIN[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_sys_uid_max_value:var:1" datatype="int" comment="Value of last SYS_UID_MAX from /etc/login.defs" version="1">
      <regex_capture pattern="SYS_UID_MAX[\s]+(\d+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <local_variable id="oval:ssg-variable_reserved_range_quad_expr:var:1" datatype="int" comment="Construct (x - 0) * (x - SYS_UID_MIN) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
        <!-- (x - 0) = x => use just "x" value -->
        <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
        <!-- Construct (x - SYS_UID_MIN) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MIN -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <local_variable id="oval:ssg-variable_dynalloc_range_quad_expr:var:1" datatype="int" comment="Construct (x - SYS_UID_MIN) * (x - SYS_UID_MAX) expression" version="1">
      <!-- Construct the final multiplication -->
      <arithmetic arithmetic_operation="multiply">
        <!-- Construct (x - SYS_UID_MIN) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MIN -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
          </arithmetic>
        </arithmetic>
        <!-- Construct (x - SYS_UID_MAX) expression -->
        <arithmetic arithmetic_operation="add">
          <!-- Get "x", thus retrieved /etc/passwd UIDs as int -->
          <variable_component var_ref="oval:ssg-variable_sys_uids_etc_passwd:var:1"/>
          <!-- Get negative value of SYS_UID_MAX -->
          <arithmetic arithmetic_operation="multiply">
            <literal_component datatype="int">-1</literal_component>
            <variable_component var_ref="oval:ssg-variable_sys_uid_max_value:var:1"/>
          </arithmetic>
        </arithmetic>
      </arithmetic>
    </local_variable>
    <external_variable comment="External variable: name of selinux policy in /etc/selinux/config" datatype="string" id="oval:ssg-var_selinux_policy_name:var:1" version="1"/>
    <external_variable comment="external variable for selinux state" datatype="string" id="oval:ssg-var_selinux_state:var:1" version="1"/>
    <local_variable id="oval:ssg-variable_last_encrypt_method_instance_value:var:1" datatype="string" comment="The value of last ENCRYPT_METHOD directive in /etc/login.defs" version="1">
      <regex_capture pattern="ENCRYPT_METHOD\s+(\w+)">
        <object_component item_field="subexpression" object_ref="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1"/>
      </regex_capture>
    </local_variable>
    <external_variable comment="timeout value" datatype="int" id="oval:ssg-sshd_idle_timeout_value:var:1" version="1"/>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1" comment="First octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1" comment="Second octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1" comment="Third octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_etc_init_d_functions_umask_as_number:var:1" comment="/etc/init.d/functions umask converted from string to a number" datatype="int" version="1">
      <arithmetic arithmetic_operation="add">
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">64</literal_component>
          <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1"/>
        </arithmetic>
        <arithmetic arithmetic_operation="multiply">
          <literal_component datatype="int">8</literal_component>
          <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1"/>
        </arithmetic>
        <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1"/>
      </arithmetic>
    </local_variable>
    <external_variable id="oval:ssg-var_umask_for_daemons_umask_as_number:var:1" comment="Required umask converted from string to octal number" datatype="int" version="1"/>
    <external_variable id="oval:ssg-var_accounts_user_umask:var:1" datatype="string" version="1" comment="Value of var_accounts_user_umask (the required umask) as string"/>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1" comment="First octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1" comment="Second octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1" comment="Third octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
      </substring>
    </local_variable>
    <external_variable id="oval:ssg-var_umask_for_daemons:var:1" datatype="string" version="1" comment="Value of var_umask_for_daemons (the required umask) as string"/>
    <local_variable id="oval:ssg-var_first_digit_of_umask_from_var_umask_for_daemons:var:1" comment="First octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
      <substring substring_start="1" substring_length="1">
        <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_second_digit_of_umask_from_var_umask_for_daemons:var:1" comment="Second octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
      <substring substring_start="2" substring_length="1">
        <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
      </substring>
    </local_variable>
    <local_variable id="oval:ssg-var_third_digit_of_umask_from_var_umask_for_daemons:var:1" comment="Third octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
      <substring substring_start="3" substring_length="1">
        <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
      </substring>
    </local_variable>
  </variables>
</oval_definitions>