{{%- set accounts_password_pam_file = '/etc/pam.d/common-password' -%}}

<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Configure the system to include use_authtok in pam common_password configuration file") }}}
    <criteria operator="AND">
        <criterion test_ref="test_{{{ rule_id }}}_pam_unix_exists"
        comment="at least one pam_unix line exists in common_password file"/>
        <criterion test_ref="test_{{{ rule_id }}}_prm_exists_not_initial"
        comment="use_authtok is configured in pam unix in common_password, ignoring first line on stack"/>
    </criteria>
  </definition>

  <ind:textfilecontent54_test id="test_{{{ rule_id }}}_pam_unix_exists" version="1"
    check="all" check_existence="at_least_one_exists"
    comment="At least one pam_unix line exists">
    <ind:object object_ref="obj_{{{ rule_id }}}_pam_unix_exists" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}_pam_unix_exists" version="1">
    <ind:filepath>{{{ accounts_password_pam_file }}}</ind:filepath>
    <ind:pattern operation="pattern match">^[ \t]*password[ \t]+[^#\n\r]+[ \t]+pam_unix\.so.*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_{{{ rule_id }}}_prm_exists_not_initial" version="1"
    check="all" check_existence="any_exist"
    comment="use_authtok is configured in pam unix in common_password file, ignoring first line on stack">
  <ind:object object_ref="obj_{{{ rule_id }}}_pam_unix_lines_not_initial" />
  <ind:state state_ref="ste_{{{ rule_id }}}_prm_exists" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}_pam_unix_lines_not_initial" version="1">
    <set>
      <object_reference>obj_{{{ rule_id }}}_password_lines_not_initial</object_reference>
      <filter action="include">ste_{{{ rule_id }}}_pam_unix_lines</filter>
    </set>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="ste_{{{ rule_id }}}_prm_exists" version="1">
      <ind:subexpression operation="pattern match">^[^#\n\r]+[ \t]+pam_unix\.so[ \t]+[^#\n\r]+use_authtok.*$</ind:subexpression>
  </ind:textfilecontent54_state>

  <!-- Get all password lines except the first line. This is to avoid matching a pam_unix
  line on the top of the stack, which does not need use_authtok to pass -->
  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}_password_lines_not_initial" version="1">
    <ind:filepath>{{{ accounts_password_pam_file }}}</ind:filepath>
    <ind:pattern operation="pattern match">^[ \t]*password[ \t]+(.+)$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">2</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="ste_{{{ rule_id }}}_pam_unix_lines" version="1">
      <ind:subexpression operation="pattern match">^[^#\n\r]+[ \t]+pam_unix\.so.*$</ind:subexpression>
  </ind:textfilecontent54_state>

</def-group>
