<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Audit rules that detect changes to the system's
      mandatory access controls (SELinux) in usr/share/selinux are enabled.") }}}

    <criteria operator="OR">
{{%- if product in ["sle15"] -%}}
      <criteria operator="AND">
        <criterion test_ref="check_selinux_policy_devel_installed"
          comment="Check no selinux-policy-devel package installed" negate="true"/>
        <criterion test_ref="check_selinux_policy_targeted_installed"
          comment="Check no selinux-policy-targeted package installed" negate="true"/>
      </criteria>
{{%- endif -%}}
      <!-- Test the augenrules_usr_share case -->
      <criteria operator="AND">
        <extend_definition definition_ref="audit_rules_augenrules"
          comment="audit augenrules in usr/share"/>
        <criterion test_ref="test_armm_selinux_watch_augenrules_usr_share"
          comment="audit selinux changes augenrules in /usr/share"/>
      </criteria>

      <!-- Test the auditctl_usr_share case -->
      <criteria operator="AND">
        <extend_definition definition_ref="audit_rules_auditctl"
          comment="audit auditctl in usr/share"/>
        <criterion test_ref="test_armm_selinux_watch_auditctl_usr_share"
          comment="audit selinux changes auditctl in usr/share"/>
      </criteria>
    </criteria>
  </definition>

{{%- if product in ["sle15"] -%}}
  {{{ oval_test_package_installed(package="selinux-policy-devel", evr="", test_id="check_selinux_policy_devel_installed") }}}
  {{{ oval_test_package_installed(package="selinux-policy-targeted", evr="", test_id="check_selinux_policy_targeted_installed") }}}
{{%- endif -%}}

  <ind:textfilecontent54_test id="test_armm_selinux_watch_augenrules_usr_share" version="1"
    check="all" comment="audit selinux changes augenrules in usr/share">
    <ind:object object_ref="object_armm_selinux_watch_augenrules_usr_share" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_armm_selinux_watch_augenrules_usr_share" version="1">
    <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
    <ind:pattern operation="pattern match">^\-w[\s]+/usr/share/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_armm_selinux_watch_auditctl_usr_share" version="1"
    check="all" comment="audit selinux changes auditctl in usr/share">
    <ind:object object_ref="object_armm_selinux_watch_auditctl_usr_share" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_armm_selinux_watch_auditctl_usr_share" version="1">
    <ind:filepath>/etc/audit/audit.rules</ind:filepath>
    <ind:pattern operation="pattern match">^\-w[\s]+/usr/share/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
