<def-group>
  <definition class="compliance" id="aide_periodic_cron_checking" version="3">
    {{{ oval_metadata("By default, AIDE does not install itself for periodic
      execution. Periodically running AIDE is necessary to reveal
      unexpected changes in installed files.
      ") }}}
    <criteria operator="AND">
      <extend_definition comment="Aide is installed" definition_ref="package_aide_installed"/>
      <criteria operator="OR">
        <criterion comment="run aide with cron" test_ref="test_aide_periodic_cron_checking"/>
        <criterion comment="run aide with cron" test_ref="test_aide_crond_checking"/>
        <criterion comment="run aide with cron" test_ref="test_aide_var_cron_checking"/>
        <criterion comment="run aide with cron.(daily|weekly)"
          test_ref="test_aide_crontabs_checking"/>
      </criteria>
    </criteria>
  </definition>

  <ind:textfilecontent54_test id="test_aide_periodic_cron_checking" check="all"
    check_existence="all_exist" comment="run aide with cron" version="1">
    <ind:object object_ref="object_test_aide_periodic_cron_checking" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_test_aide_periodic_cron_checking"
    comment="run aide with cron" version="1">
    <ind:filepath>/etc/crontab</ind:filepath>
    <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*{{{ aide_bin_path | replace("/", "\/") }}}[\s]*\-\-check.*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_aide_crond_checking" check="all" check_existence="all_exist"
    comment="run aide with cron" version="1">
    <ind:object object_ref="object_test_aide_crond_checking" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_test_aide_crond_checking" comment="run aide with cron"
    version="1">
    <ind:path>/etc/cron.d</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*{{{ aide_bin_path | replace("/", "\/") }}}[\s]*\-\-check.*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_aide_var_cron_checking" check="all"
    check_existence="all_exist" comment="run aide with cron" version="1">
    <ind:object object_ref="object_aide_var_cron_checking" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_aide_var_cron_checking" version="1"
    comment="run aide with cron">
    <ind:filepath>/var/spool/cron/root</ind:filepath>
    <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*(root)?[\s]*{{{ aide_bin_path | replace("/", "\/") }}}[\s]*\-\-check.*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
    comment="run aide with cron.(daily|weekly)" id="test_aide_crontabs_checking" version="2">
    <ind:object object_ref="object_aide_crontabs_checking" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_aide_crontabs_checking"
    comment="run aide with cron.(daily|weekly)" version="1">
    <ind:path operation="pattern match">^/etc/cron.(daily|weekly)$</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">^[^#]*{{{ aide_bin_path | replace("/", "\/") }}}\s+\-\-check\s*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
