{{% set file_stem = ["auth","account","password","session"] %}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
  {{{ oval_metadata("Ensure pam_unix.so is properly configured in PAM configuration files") }}}
    <criteria operator="AND" comment="Check if pam_unix.so is properly defined in all PAM files">      
      {{% for stem in file_stem %}}
      <criterion test_ref="test_pam_unix_common_{{{ stem }}}"
          comment="pam_unix has correctly set in common-{{{ stem }}}"/>
      {{% endfor %}}
    </criteria>
  </definition>

  <!-- Check occurrences of pam_unix.so in common-{auth,account,password} file -->
  {{% macro test_pam_unix(stem) %}}
  <ind:textfilecontent54_test check="all" id="test_pam_unix_common_{{{ stem }}}" version="1"
        check_existence="only_one_exists"
        comment="No more than one pam_unix.so is expected in {{{ stem }}} section of /etc/pam.d/common-{{{ stem }}}">
    <ind:object object_ref="obj_pam_unix_common_{{{ stem }}}" />
  </ind:textfilecontent54_test>
  {{% endmacro %}}

  {{% macro object_pam_unix(stem) %}}
  <ind:textfilecontent54_object id="obj_pam_unix_common_{{{ stem }}}" version="1"
        comment="Get the occurrences of pam_unix.so in {{{ stem }}} section of /etc/pam.d/common-{{{ stem }}}">
    <ind:filepath>/etc/pam.d/common-{{{ stem }}}</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*{{{stem}}}[\s]+(required|\[(?=.*?\bsuccess=\d+\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bdefault=ignore\b)?.*\])[\s]+pam_unix\.so.*$</ind:pattern>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>
  {{% endmacro %}}

  {{% for file in file_stem %}}
  {{{ test_pam_unix(stem=file) }}}
  {{{ object_pam_unix(stem=file) }}}
  {{% endfor %}}

</def-group>
