<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Only members of the wheel group should be able to authenticate through the su command.") }}}
    <criteria operator="AND">
      <criterion test_ref="test_use_pam_wheel_for_su" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test id="test_use_pam_wheel_for_su" version="1"
    check="all" check_existence="at_least_one_exists"
    comment="check existence of use_uid option for pam_wheel.so in /etc/pam.d/su">
    <ind:object object_ref="object_use_pam_wheel_for_su" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_use_pam_wheel_for_su" version="1"
    comment="collect pam_wheel.so line in /etc/pam.d/su if use_uid option is present in the line">
    <ind:filepath>/etc/pam.d/su</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+\buse_uid\b</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
