<def-group>
  <definition class="compliance" id="aide_check_audit_tools" version="1">
    {{{ oval_metadata("The " ~ full_name ~ " operating system file integrity tool must be configured to protect the integrity of the audit tools.", title="Configure AIDE to Verify the Audit Tools") }}}
    <criteria operator="AND">
      <extend_definition comment="Aide is installed" definition_ref="package_aide_installed" />
      <criterion comment="auditctl is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_auditctl" />
      <criterion comment="auditd is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_auditd" />
      <criterion comment="ausearch is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_ausearch" />
      <criterion comment="aureport is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_aureport" />
      <criterion comment="autrace is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_autrace" />
      {{% if aide_also_checks_audispd == "yes" %}}
      <criterion comment="audispd is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_audispd" />
      {{% endif %}}
      {{% if aide_also_checks_rsyslog == "yes" %}}
      <criterion comment="rsyslogd is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_rsyslogd" />
      {{% endif %}}
      <criterion comment="augenrules is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_augenrules" />
    </criteria>
  </definition>

  <ind:textfilecontent54_state id="state_aide_check_attributes" version="1">
    {{% if 'rhel' not in product and 'ubuntu' not in product and 'ol' not in product %}}
    <ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
    {{% else %}}
    <ind:subexpression operation="pattern match">^p\+i\+n\+u\+g\+s\+b\+acl(|\+selinux)\+xattrs\+sha512$</ind:subexpression>
    {{% endif %}}
  </ind:textfilecontent54_state>

  <ind:textfilecontent54_test id="test_aide_verify_auditctl"
  comment="auditctl is checked in {{{ aide_conf_path }}}" check="all"
  check_existence="all_exist" version="1">
    <ind:object object_ref="object_aide_verify_auditctl" />
    <ind:state state_ref="state_aide_check_attributes" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_aide_verify_auditctl"
  version="1">
    <ind:filepath>{{{ aide_conf_path }}}</ind:filepath>
    <ind:pattern operation="pattern match">^\/usr\/sbin\/auditctl\s+([^\n]+)$</ind:pattern>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_aide_verify_auditd"
  comment="auditd is checked in {{{ aide_conf_path }}}" check="all"
  check_existence="all_exist" version="1">
    <ind:object object_ref="object_aide_verify_auditd" />
    <ind:state state_ref="state_aide_check_attributes" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_aide_verify_auditd"
  version="1">
    <ind:filepath>{{{ aide_conf_path }}}</ind:filepath>
    <ind:pattern operation="pattern match">^/usr/sbin/auditd\s+([^\n]+)$</ind:pattern>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_aide_verify_ausearch"
  comment="ausearch is checked in {{{ aide_conf_path }}}" check="all"
  check_existence="all_exist" version="1">
    <ind:object object_ref="object_aide_verify_ausearch" />
    <ind:state state_ref="state_aide_check_attributes" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_aide_verify_ausearch"
  version="1">
    <ind:filepath>{{{ aide_conf_path }}}</ind:filepath>
    <ind:pattern operation="pattern match">^/usr/sbin/ausearch\s+([^\n]+)$</ind:pattern>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_aide_verify_aureport"
  comment="aureport is checked in {{{ aide_conf_path }}}" check="all"
  check_existence="all_exist" version="1">
    <ind:object object_ref="object_aide_verify_aureport" />
    <ind:state state_ref="state_aide_check_attributes" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_aide_verify_aureport"
  version="1">
    <ind:filepath>{{{ aide_conf_path }}}</ind:filepath>
    <ind:pattern operation="pattern match">^/usr/sbin/aureport\s+([^\n]+)$</ind:pattern>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_aide_verify_autrace"
  comment="autrace is checked in {{{ aide_conf_path }}}" check="all"
  check_existence="all_exist" version="1">
    <ind:object object_ref="object_aide_verify_autrace" />
    <ind:state state_ref="state_aide_check_attributes" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_aide_verify_autrace"
  version="1">
    <ind:filepath>{{{ aide_conf_path }}}</ind:filepath>
    <ind:pattern operation="pattern match">^/usr/sbin/autrace\s+([^\n]+)$</ind:pattern>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>

{{% if aide_also_checks_audispd == "yes" %}}
  <ind:textfilecontent54_test id="test_aide_verify_audispd"
  comment="audispd is checked in {{{ aide_conf_path }}}" check="all"
  check_existence="all_exist" version="1">
    <ind:object object_ref="object_aide_verify_audispd" />
    <ind:state state_ref="state_aide_check_attributes" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_aide_verify_audispd"
  version="1">
    <ind:filepath>{{{ aide_conf_path }}}</ind:filepath>
    <ind:pattern operation="pattern match">^/usr/sbin/audispd\s+([^\n]+)$</ind:pattern>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>
{{% endif %}}

{{% if aide_also_checks_rsyslog == "yes" %}}
  <ind:textfilecontent54_test id="test_aide_verify_rsyslogd"
  comment="rsyslogd is checked in {{{ aide_conf_path }}}" check="all"
  check_existence="all_exist" version="1">
    <ind:object object_ref="object_aide_verify_rsyslogd" />
    <ind:state state_ref="state_aide_check_attributes" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_aide_verify_rsyslogd"
  version="1">
    <ind:filepath>{{{ aide_conf_path }}}</ind:filepath>
    <ind:pattern operation="pattern match">^/usr/sbin/rsyslogd\s+([^\n]+)$</ind:pattern>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>
{{% endif %}}

  <ind:textfilecontent54_test id="test_aide_verify_augenrules"
  comment="augenrules is checked in {{{ aide_conf_path }}}" check="all"
  check_existence="all_exist" version="1">
    <ind:object object_ref="object_aide_verify_augenrules" />
    <ind:state state_ref="state_aide_check_attributes" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_aide_verify_augenrules"
  version="1">
    <ind:filepath>{{{ aide_conf_path }}}</ind:filepath>
    <ind:pattern operation="pattern match">^/usr/sbin/augenrules\s+([^\n]+)$</ind:pattern>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
