<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="3">
    {{{ oval_metadata("Make sure systemd timer is defined to run perodic AIDE check.") }}}
    <criteria operator="AND">
      <extend_definition comment="Aide is installed" definition_ref="package_aide_installed"/>
      <criteria operator="AND">
        <criterion test_ref="tst_aidecheck-service_enabled"
          comment="systemd aidecheck.service enabled"/>
        <criterion test_ref="tst_aidecheck-timer_enabled"
          comment="systemd aidecheck.timer enabled"/>
        <criterion test_ref="tst_aidecheck-timer_active"
          comment="systemd aidecheck.timer active"/>
      </criteria>
    </criteria>
  </definition>

  <linux:systemdunitproperty_object id="obj_aidecheck-service_unitfilestate" version="1">
    <linux:unit>aidecheck.service</linux:unit>
    <linux:property>UnitFileState</linux:property>
  </linux:systemdunitproperty_object>
  <linux:systemdunitproperty_object id="obj_aidecheck-timer_unitfilestate" version="1">
    <linux:unit>aidecheck.timer</linux:unit>
    <linux:property>UnitFileState</linux:property>
  </linux:systemdunitproperty_object>
  <linux:systemdunitproperty_object id="obj_aidecheck-timer_activestate" version="1">
    <linux:unit>aidecheck.timer</linux:unit>
    <linux:property>ActiveState</linux:property>
  </linux:systemdunitproperty_object>
  <linux:systemdunitproperty_state id="ste_aide_is_enabled" version="1">
    <linux:value>enabled</linux:value>
  </linux:systemdunitproperty_state>
  <linux:systemdunitproperty_state id="ste_aide_is_active" version="1">
    <linux:value>active</linux:value>
  </linux:systemdunitproperty_state>

  <linux:systemdunitproperty_test check="all" id="tst_aidecheck-service_enabled" version="1"
    comment="systemd aidecheck.service enabled">
    <linux:object object_ref="obj_aidecheck-service_unitfilestate" />
    <linux:state state_ref="ste_aide_is_enabled" />
  </linux:systemdunitproperty_test>
  <linux:systemdunitproperty_test check="all" id="tst_aidecheck-timer_enabled" version="1"
    comment="systemd aidecheck.timer enabled">
    <linux:object object_ref="obj_aidecheck-timer_unitfilestate" />
    <linux:state state_ref="ste_aide_is_enabled" />
  </linux:systemdunitproperty_test>
  <linux:systemdunitproperty_test check="all" id="tst_aidecheck-timer_active" version="1"
    comment="systemd aidecheck.timer active">
    <linux:object object_ref="obj_aidecheck-timer_activestate" />
    <linux:state state_ref="ste_aide_is_active" />
  </linux:systemdunitproperty_test>
</def-group>
