<def-group>
  <definition class="compliance" id="aide_check_audit_tools" version="1">
    {{{ oval_metadata("The " ~ full_name ~ " operating system file integrity tool must be configured to protect the integrity of the audit tools.", title="Configure AIDE to Verify the Audit Tools", rule_title=rule_title) }}}
    <criteria operator="AND">
      <extend_definition comment="Aide is installed" definition_ref="package_aide_installed" />
      <criterion comment="auditctl is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_auditctl" />
      <criterion comment="auditd is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_auditd" />
      <criterion comment="ausearch is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_ausearch" />
      <criterion comment="aureport is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_aureport" />
      <criterion comment="autrace is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_autrace" />
      {{% if aide_also_checks_audispd == "yes" %}}
      <criterion comment="audispd is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_audispd" />
      {{% endif %}}
      {{% if aide_also_checks_rsyslog == "yes" %}}
      <criterion comment="rsyslogd is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_rsyslogd" />
      {{% endif %}}
      <criterion comment="augenrules is checked in {{{ aide_conf_path }}}" test_ref="test_aide_verify_augenrules" />
    </criteria>
  </definition>

  <ind:textfilecontent54_state id="state_aide_check_attributes" version="1">
    {{% if 'rhel' not in product and 'ubuntu' not in product and 'ol' not in families and 'fedora' not in product %}}
    <ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
    {{% else %}}
    <ind:subexpression operation="pattern match">^p\+i\+n\+u\+g\+s\+b\+acl(|\+selinux)\+xattrs\+sha512$</ind:subexpression>
    {{% endif %}}
  </ind:textfilecontent54_state>

  {{%- set audit_tools_list = ['auditctl', 'auditd', 'ausearch', 'aureport', 'autrace', 'audispd', 'rsyslogd', 'augenrules'] -%}}
  {{%- for audit_tool in audit_tools_list -%}}
    {{{ oval_test_aide_audit_tools(audit_tool) }}}
  {{%- endfor %}}
</def-group>
