<def-group>
    <definition class="compliance" id="bios_enable_execution_restrictions" version="2">
        {{{ oval_metadata("The NX (no-execution) bit flag should be set on the system.") }}}
        <criteria operator="AND">
            <criterion comment="NX bit is set" test_ref="test_NX_cpu_support" />
            <criterion comment="NX is not disabled in the kernel command line" test_ref="test_noexec_cmd_line" />
        </criteria>
    </definition>

    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="CPUs support for NX bit" id="test_NX_cpu_support" version="1">
        <ind:object object_ref="obj_NX_cpu_support" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_test check="all" check_existence="none_exist" id="test_noexec_cmd_line" version="1" comment="NX is not disabled in the kernel command line">
        <ind:object object_ref="obj_noexec_cmd_line" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="obj_NX_cpu_support" version="1">
        <ind:filepath>/proc/cpuinfo</ind:filepath>
        <ind:pattern operation="pattern match">^flags[\s]+:.*[\s]+nx[\s]+.*$</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_object id="obj_noexec_cmd_line" version="1">
        <ind:filepath>/proc/cmdline</ind:filepath>
        <ind:pattern operation="pattern match">.+noexec[0-9]*=off.+</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>
</def-group>
