<def-group>
  <definition class="compliance" id="audit_rules_system_shutdown" version="1">
    {{{ oval_metadata("The system will shutdown when auditing fails.") }}}

    <criteria operator="OR">

      <!-- Test the augenrules case -->
      <criteria operator="AND">
        <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
        <criterion comment="audit augenrules configuration shutdown" test_ref="test_ars_shutdown_augenrules" />
      </criteria>

      <!-- Test the auditctl case -->
      <criteria operator="AND">
        <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
        <criterion comment="audit auditctl configuration shutdown" test_ref="test_ars_shutdown_auditctl" />
      </criteria>

    </criteria>
  </definition>

  <ind:textfilecontent54_test check="at least one" comment="audit augenrules configuration shutdown" id="test_ars_shutdown_augenrules" version="1">
    <ind:object object_ref="object_ars_shutdown_augenrules" />
    <ind:state state_ref="state_ars_shutdown" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_ars_shutdown_augenrules" version="1">
    <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
    <ind:pattern operation="pattern match">^\-f\s+(\d)\s*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_state id="state_ars_shutdown" version="1">
    <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="var_audit_failure_mode" />
  </ind:textfilecontent54_state>

  <ind:textfilecontent54_test check="all" comment="audit auditctl configuration shutdown" id="test_ars_shutdown_auditctl" version="1">
    <ind:object object_ref="object_ars_shutdown_auditctl" />
    <ind:state state_ref="state_ars_shutdown" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_ars_shutdown_auditctl" version="1">
    <ind:filepath>/etc/audit/audit.rules</ind:filepath>
    <ind:pattern operation="pattern match">^\-f\s+(\d)\s*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <external_variable comment="external variable for audit failure mode"
    datatype="string" id="var_audit_failure_mode" version="1" />
</def-group>
