<def-group>
  <definition class="compliance" id="grub2_enable_fips_mode" version="1">
    {{{ oval_metadata("Ensure fips=1 is configured in the kernel line in /etc/default/grub.") }}}
    <criteria operator="AND">
      <extend_definition comment="Installed OS is FIPS certified" definition_ref="installed_OS_is_FIPS_certified" />
      <extend_definition comment="prelink disabled" definition_ref="disable_prelink" />
      <extend_definition comment="package dracut-fips installed" definition_ref="package_dracut-fips_installed" />
      <extend_definition comment="package dracut-fips-aesni installed" definition_ref="package_dracut-fips-aesni_installed" />
      <extend_definition comment="check /etc/system-fips exists" definition_ref="etc_system_fips_exists" />
      <criteria operator="OR">
        <criterion test_ref="test_grub2_enable_fips_mode" comment="check for fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" />
        <criteria operator="AND">
          <extend_definition definition_ref="grub2_default_exists" comment="check for GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub" />
          <criterion test_ref="test_grub2_enable_fips_mode_default" comment="check for fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" />
          <criterion test_ref="test_grub2_enable_fips_mode" comment="check for fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX" />
        </criteria>
      </criteria>
    </criteria>
  </definition>

  <ind:textfilecontent54_test id="test_grub2_enable_fips_mode"
  comment="check for fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX"
  check="all" check_existence="all_exist" version="1">
    <ind:object object_ref="object_grub2_enable_fips_mode" />
    <ind:state state_ref="state_grub2_enable_fips_mode" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_grub2_enable_fips_mode" version="1">
    <ind:filepath>/etc/default/grub</ind:filepath>
    <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(.*)"$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_grub2_enable_fips_mode_default"
  comment="check for fips=1 in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT"
  check="all" check_existence="all_exist" version="1">
    <ind:object object_ref="object_grub2_enable_fips_mode_default" />
    <ind:state state_ref="state_grub2_enable_fips_mode" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_grub2_enable_fips_mode_default" version="1">
    <ind:filepath>/etc/default/grub</ind:filepath>
    <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT="(.*)"$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_grub2_enable_fips_mode" version="1">
    <ind:subexpression datatype="string" operation="pattern match">^.*fips=1.*$</ind:subexpression>
  </ind:textfilecontent54_state>
</def-group>
