{{#
Generates the :code:`<affected>` tag for OVAL check using correct product platforms.

:param products: Name of products
:type products: str

#}}
{{%- macro oval_affected(products) %}}
<affected family="unix">
{{{ product_to_platform(products)|indent(2) }}}
</affected>
{{%- endmacro %}}


{{#
  Constants.

#}}
{{%- set suffix_id_default_not_overriden = "_default_not_overriden" -%}}

{{#
  High level macro which checks if a particular combination of parameter and value in a configuration file is set.

:param path: Path to the configuration file to be checked.
:type path: str
:param prefix_regex: Regular expression to be used in the beginning of the OVAL text file content check.
:type prefix_regex: str
:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param separator_regex: Regular expression to be used as the separator of parameter and value in a configuration file. If spaces are allowed, this should be included in the regular expression.
:type separator_regex: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param application: The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
:type application: str
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param missing_config_file_fail: If set, the check will fail if the configuration is not existent in the system.
:type missing_config_file_fail: bool
:param section: If set, the parameter will be checked only within the given section defined by [section].
:type section: str
:param quotes: If non-empty, one level of matching quotes is considered when checking the value. See comment of oval_line_in_file_state for more info.
:type quotes: str

#}}
{{%- macro oval_check_config_file(path='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', value='', missing_parameter_pass=false, application='', multi_value=false, missing_config_file_fail=false, section='', quotes='') -%}}
{{%- if application == '' -%}}
	{{%- set application = "The respective application or service" -%}}
{{%- endif -%}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Ensure '" + parameter + "' is configured with value '" + value | replace("(?i)", "") | replace("(?-i)", "") + (" in section '" + section if section else "") + "' in " + path) }}}
    {{%- if missing_config_file_fail %}}
    <criteria comment="{{{ application }}} is configured correctly and configuration file exists"
    operator="AND">
    {{%- endif %}}
    {{%- if application == "sshd" %}}
{{#-
    This condition is here to avoid regression in sshd configuration rules.
    The OVAL checks for sshd configuration test if the package is installed
    and if it is required or not by the profile. When rule applicability is
    done for these rules, it can be removed.
#}}
    <criteria comment="{{{ application }}} is configured correctly or is not installed"
    operator="OR">
        {{{- application_not_required_or_requirement_unset() }}}
        {{{- application_required_or_requirement_unset() }}}
    {{%- endif %}}
    <criteria comment="{{{ application }}} is configured correctly"
    operator="OR">
        {{{- oval_line_in_file_criterion(path, parameter) }}}
        {{%- if missing_parameter_pass %}}
        {{{- oval_line_in_file_criterion(path, parameter, missing_parameter_pass) }}}
        {{%- endif %}}
    </criteria>
    {{%- if application == "sshd" %}}
    </criteria> {{# close criteria left open in application_required_or_requirement_unset #}}
    </criteria>
    {{%- endif %}}
    {{%- if missing_config_file_fail %}}
        {{{- oval_config_file_exists_criterion(path) }}}
    </criteria>
    {{%- endif %}}
  </definition>
  {{{ oval_line_in_file_test(path, parameter) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, false, multi_value) }}}
  {{{ oval_line_in_file_state(value, multi_value, quotes) }}}
  {{%- if missing_parameter_pass %}}
  {{{ oval_line_in_file_test(path, parameter, missing_parameter_pass) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, missing_parameter_pass, multi_value) }}}
  {{%- endif %}}
  {{%- if missing_config_file_fail %}}
  {{{ oval_config_file_exists_test(path) }}}
  {{{ oval_config_file_exists_object(path) }}}
  {{%- endif %}}

</def-group>
{{%- endmacro %}}


{{#
  High level macro which checks if a particular combination of parameter and value in a systemd configuration is set.

:param path: Path to the configuration file to be checked. This parameter is used also to construct directory for drop-in configuration files.
:type path: str
:param prefix_regex: Regular expression to be used in the beginning of the OVAL text file content check.
:type prefix_regex: str
:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param separator_regex: Regular expression to be used as the separator of parameter and value in a configuration file. If spaces are allowed, this should be included in the regular expression.
:type separator_regex: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: boolean
:param application: The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
:type application: str
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: boolean
:param section: If set, the parameter will be checked only within the given section defined by [section].
:type section: str
:param quotes: If non-empty, one level of matching quotes is considered when checking the value. See comment of oval_line_in_file_state for more info.
:type quotes: str

#}}
{{%- macro oval_check_systemd_config(path='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', value='', missing_parameter_pass=false, application='', multi_value=false, section='', quotes='') -%}}
{{%- if application == '' -%}}
	{{%- set application = "The respective application or service" -%}}
{{%- endif -%}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Ensure '" + parameter + "' is configured with value '" + value | replace("(?i)", "") | replace("(?-i)", "") + (" in section '" + section if section else "") + "' in " + path) }}}
    {{% set dir_path = path + ".d" %}}
    <criteria comment="{{{ application }}} is configured correctly"
    operator="OR">
        {{{- oval_line_in_file_criterion(path, parameter) }}}
        {{{- oval_line_in_directory_criterion(dir_path, parameter) }}}
        {{%- if missing_parameter_pass %}}
        {{{- oval_line_in_file_criterion(path, parameter, missing_parameter_pass) }}}
        {{{- oval_line_in_directory_criterion(dir_path, parameter, missing_parameter_pass) }}}
        {{%- endif %}}
    </criteria>
  </definition>
  {{{ oval_line_in_file_test(path, parameter) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, false, multi_value) }}}
  {{{ oval_line_in_file_state(value, multi_value, quotes) }}}
  {{{ oval_line_in_directory_test(dir_path, parameter) }}}
  {{{ oval_line_in_directory_object(dir_path, section, prefix_regex, parameter, separator_regex, false, multi_value) }}}
  {{{ oval_line_in_directory_state(value, multi_value, quotes) }}}
  {{%- if missing_parameter_pass %}}
  {{{ oval_line_in_file_test(path, parameter, missing_parameter_pass) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, missing_parameter_pass, multi_value) }}}
  {{{ oval_line_in_directory_test(dir_path, parameter, missing_parameter_pass) }}}
  {{{ oval_line_in_directory_object(dir_path, section, prefix_regex, parameter, separator_regex, missing_parameter_pass, multi_value) }}}
  {{%- endif %}}

</def-group>
{{%- endmacro %}}

{{#
  Macro to define the criterion of the OVAL check (Criterion definition).

:param path: Path to the configuration file to be checked.
:type path: str
:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param comment: Optional criterion comment
:type comment: str
:param id_stem: The first suffix of tests, objects etc. that ensures uniqueness of the particular OVAL entity ID. Defaults to the rule ID.
:type id_stem: str
:param avoid_conflicting: If true, the check will only pass in case all (if any) configurations found are compliant
:type avoid_conflicting: bool

#}}
{{%- macro oval_line_in_file_criterion(path='', parameter='', missing_parameter_pass=false, comment='', id_stem='', avoid_conflicting=false) -%}}
{{%- set id_stem = id_stem or rule_id -%}}
{{%- set suffix_id = "" -%}}
{{%- set prefix_text = "Check the" -%}}
{{%- set suffix_text = "" -%}}
{{%- if missing_parameter_pass %}}
{{%- set suffix_id = suffix_id_default_not_overriden -%}}
{{%- set prefix_text = prefix_text + " absence of" -%}}
{{%- elif avoid_conflicting -%}}
{{%- set suffix_text = "if any" -%}}
{{%- endif %}}
{{%- if not comment -%}}
{{%- set comment = prefix_text ~ " " ~ parameter ~ " in " ~ path ~ suffix_text -%}}
{{%- endif -%}}
<criterion comment="{{{ comment }}}"
  test_ref="test_{{{ id_stem }}}{{{ suffix_id }}}" />
{{%- endmacro %}}


{{#
  Macro to define the OVAL test to be constructed (Test definition).

:param path: Path to the configuration file to be checked.
:type path: str
:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param id_stem: The first suffix of tests, objects etc. that ensures uniqueness of the particular OVAL entity ID. Defaults to the rule ID.
:type id_stem: str

#}}
{{%- macro oval_line_in_file_test(path='', parameter='', missing_parameter_pass=false, id_stem='', avoid_conflicting=false) -%}}
{{%- set id_stem = id_stem or rule_id -%}}
{{%- set suffix_id = "" -%}}
{{%- set suffix_text = "" -%}}
{{%- if missing_parameter_pass %}}
{{%- set check_existence = "none_exist" -%}}
{{%- set prefix_text = "absence" -%}}
{{%- set suffix_id = suffix_id_default_not_overriden -%}}
{{%- elif  avoid_conflicting -%}}
{{%- set check_existence = "any_exist" -%}}
{{%- set prefix_text = "value" -%}}
{{%- set suffix_text = "if any" -%}}
{{%- else %}}
{{%- set check_existence = "all_exist" -%}}
{{%- set prefix_text = "value" -%}}
{{%- endif %}}
<ind:textfilecontent54_test check="all" check_existence="{{{ check_existence }}}"
  comment="tests the {{{ prefix_text }}} of {{{ parameter }}} setting in the {{{ path }}} file"
  id="test_{{{ id_stem }}}{{{ suffix_id }}}" version="1">
  <ind:object object_ref="obj_{{{ id_stem }}}{{{ suffix_id }}}" />
  {{%- if not missing_parameter_pass %}}
  <ind:state state_ref="state_{{{ id_stem }}}{{{ suffix_id }}}" />
  {{%- endif %}}
</ind:textfilecontent54_test>
{{%- endmacro %}}


{{#
  Macro to check if a parameter in a configuration file is set (Object definition).

:param path_or_filepath: Either `filepath` to the configuration file to be checked, or if `filename_regex` is specified, path to the directory where filenames are matched against it.
:type path_or_filepath: str
:param section: If set, the parameter will be checked only within the given section defined by [section].
:type section: str
:param prefix_regex: Regular expression to be used in the beginning of the OVAL text file content check.
:type prefix_regex: str
:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param separator_regex: Regular expression to be used as the separator of parameter and value in a configuration file. If spaces are allowed, this should be included in the regular expression.
:type separator_regex: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param filename_regex: If specified, the first argument is interpreted as `path`, and this will serve as `filename` regex.
:type filename_regex: str
:param id_stem: The first suffix of tests, objects etc. that ensures uniqueness of the particular OVAL entity ID. Defaults to the rule ID.
:type id_stem: str

#}}
{{%- macro oval_line_in_file_object(path_or_filepath='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false, filename_regex='', id_stem='') -%}}
{{%- set id_stem = id_stem or rule_id -%}}
{{%- set suffix_id = "" -%}}
{{%- if multi_value -%}}
{{%- set group_regex = "([^#]*).*$" -%}}
{{%- else -%}}
{{%- set group_regex = "(.+?)[ \\t]*(?:$|#)" -%}}
{{%- endif -%}}
{{%- if section %}}
{{%- set common_regex = "^\s*\["+section+"\].*(?:\\n\s*[^[\s].*)*\\n"+prefix_regex+parameter+separator_regex -%}}
{{%- if missing_parameter_pass %}}
{{#
  There is no need for having a regular expression with a capture
  group "(\S*)" when checking if the parameter is not present in
  the configuration file.
#}}
{{%- set regex = common_regex -%}}
{{%- else %}}
{{%- set regex = common_regex+group_regex -%}}
{{%- endif %}}
{{%- else %}}
{{%- if missing_parameter_pass %}}
{{%- set suffix_id = suffix_id_default_not_overriden -%}}
{{#
  There is no need for having a regular expression with a capture
  group "(.*)" when checking if the parameter is not present in
  the configuration file.
#}}
{{%- set regex = prefix_regex+parameter+separator_regex -%}}
{{%- else %}}
{{%- set regex = prefix_regex+parameter+separator_regex+group_regex -%}}
{{%- endif %}}
{{%- endif %}}
<ind:textfilecontent54_object id="obj_{{{ id_stem }}}{{{ suffix_id }}}" version="1">
{{%- if filename_regex %}}
  <ind:path>{{{ path_or_filepath }}}</ind:path>
  <ind:filename operation="pattern match">{{{ filename_regex }}}</ind:filename>
{{%- else %}}
  <ind:filepath>{{{ path_or_filepath }}}</ind:filepath>
{{%- endif %}}
  <ind:pattern operation="pattern match">{{{ regex }}}</ind:pattern>
  <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
{{%- endmacro %}}


{{#
  Macro to check if a expected value can be found in the extracted information of an OVAL object (State definition).

:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param quotes: If non-empty, one level of matching quotes is considered when checking the value. Specify one or more quote types as a string.  For example, for shell quoting, specify quotes="'\""), which will make sure that value, 'value' and "value" are matched, but 'value" or '"value"' won't be.
:type quotes: str
:param id_stem: The first suffix of tests, objects etc. that ensures uniqueness of the particular OVAL entity ID. Defaults to the rule ID.
:type id_stem: str

#}}
{{%- macro oval_line_in_file_state(value='', multi_value=false, quotes='', id_stem='') -%}}
{{%- set id_stem = id_stem or rule_id -%}}
{{%- set regex = value -%}}
{{%- if quotes != "" %}}
{{%- if "\\1" in value > 0 %}}
{{{ raise("The regex for matching '%s' already references capturing groups, which doesn't go well with quoting that adds a capturing group to the beginning." % value) }}}
{{%- endif %}}
{{%- set regex =  "((?:%s)?)%s\\1" % ("|".join(quotes), regex) -%}}
{{%- endif %}}
{{%- if multi_value %}}
{{%- set regex = "^.*\\b"+regex+"\\b.*$" -%}}
{{%- else %}}
{{%- set regex = "^"+regex+"$" -%}}
{{%- endif %}}
<ind:textfilecontent54_state id="state_{{{ id_stem }}}" version="1">
  <ind:subexpression datatype="string" operation="pattern match">{{{ regex }}}</ind:subexpression>
</ind:textfilecontent54_state>
{{%- endmacro %}}

{{% macro oval_line_in_file_define_variable(var_name, datatype) %}}
<local_variable id="local_var_regex_{{{ rule_id }}}"
comment="Regex that matches exact value represented by {{{ var_name }}} XCCDF variable"
datatype="{{{ datatype }}}" version="1">
    <variable_component var_ref="{{{ var_name }}}" />
</local_variable>

<external_variable comment="Variable defining the value the argument should have" datatype="{{{ datatype }}}" id="{{{ var_name }}}" version="1" />
{{% endmacro %}}

{{%- macro oval_line_in_file_state_xccdf_variable(var_name='', id_stem='', datatype='') -%}}
{{%- set id_stem = id_stem or rule_id -%}}
<ind:textfilecontent54_state id="state_{{{ id_stem }}}" version="1">
  <ind:subexpression datatype="{{{ datatype }}}" operation="equals" var_ref="local_var_regex_{{{ rule_id }}}" />
</ind:textfilecontent54_state>
{{%- endmacro -%}}


{{%- macro oval_line_in_directory_criterion(path='', parameter='', missing_parameter_pass=false, avoid_conflicting=false) -%}}
{{{- oval_line_in_file_criterion(path, parameter, missing_parameter_pass, id_stem=rule_id ~ "_config_dir", avoid_conflicting=avoid_conflicting) -}}}
{{%- endmacro %}}


{{%- macro oval_line_in_directory_test(path='', parameter='', missing_parameter_pass=false, avoid_conflicting=false) -%}}
{{{ oval_line_in_file_test(path, parameter, missing_parameter_pass, id_stem=rule_id ~ "_config_dir", avoid_conflicting=avoid_conflicting) }}}
{{%- endmacro %}}


{{%- macro oval_line_in_directory_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false) -%}}
{{{- oval_line_in_file_object(path_or_filepath=path, section=section, prefix_regex=prefix_regex, parameter=parameter, separator_regex=separator_regex, missing_parameter_pass=missing_parameter_pass, multi_value=multi_value, filename_regex=".*\.conf$", id_stem=rule_id ~ "_config_dir") -}}}
{{%- endmacro %}}


{{%- macro oval_line_in_directory_state(value='', multi_value='', quotes='') -%}}
{{{- oval_line_in_file_state(value, multi_value, quotes, id_stem=rule_id ~ "_config_dir") -}}}
{{%- endmacro %}}

{{%- macro oval_line_in_directory_state_xccdf_variable(var_name='', datatype='') -%}}
{{{- oval_line_in_file_state_xccdf_variable(var_name, id_stem=rule_id ~ "_config_dir", datatype=datatype) -}}}
{{%- endmacro -%}}

{{#
  Macro to define the OVAL criterion to check if the configuration file exists (Criterion definition).

:param path: Path to the configuration file to be checked.
:type path: str

#}}
{{%- macro oval_config_file_exists_criterion(path='') -%}}
	<criterion comment="test if configuration file {{{ path }}} exists for {{{ rule_id }}}" test_ref="test_{{{ rule_id }}}_config_file_exists" />
{{%- endmacro %}}


{{#
  Macro to define the OVAL test to check if the configuration file exists (Test definition).

:param path: Path to the configuration file to be checked.
:type path: str

#}}
{{%- macro oval_config_file_exists_test(path='') -%}}
  <unix:file_test id="test_{{{ rule_id }}}_config_file_exists" check="all" check_existence="all_exist" comment="The configuration file {{{ path }}} exists for {{{ rule_id }}}" version="1">
    <unix:object object_ref="obj_{{{ rule_id }}}_config_file" />
  </unix:file_test>
{{%- endmacro %}}


{{#
  Macro to define the OVAL criterion that requires a file not to exist.
  The id of the test name will be test_<id>.

:param filepath: Path to the file to be checked.
:type filepath: str

#}}
{{%- macro oval_file_absent_criterion(filepath) -%}}
  <criterion comment="Pass if there are no files matching pattern '{{{ filepath }}}' exist in the system" test_ref="test_{{{ rule_id }}}_file_{{{ filepath|escape_id }}}_absent" />
{{%- endmacro %}}


{{#
  Macro to define the OVAL test to check if the configuration file exists (Test definition).

:param filepath_regex: Regex to the filepath to be checked, will be prefixed by ^.
:type filepath_regex: str

#}}
{{%- macro oval_file_absent(filepath_regex) -%}}
  <unix:file_test check="all" check_existence="none_exist" id="test_{{{ rule_id }}}_file_{{{ filepath_regex|escape_id }}}_absent"
  comment="Check if {{{ filepath_regex }}} does not exist" version="1">
    <unix:object object_ref="object_{{{ rule_id }}}_file_{{{ filepath_regex|escape_id }}}_absent" />
  </unix:file_test>
  <unix:file_object id="object_{{{ rule_id }}}_file_{{{ filepath_regex|escape_id }}}_absent" version="1">
    <unix:filepath operation="pattern match">^{{{ filepath_regex }}}</unix:filepath>
  </unix:file_object>
{{%- endmacro %}}


{{#
  Macro to define the OVAL object to check if the configuration file exists (Object definition).

:param filepath_regex: Regex to the filepath to be checked, will be prefixed by ^.
:type filepath_regex: str

#}}
{{%- macro oval_config_file_exists_object(filepath_regex='') -%}}
  <unix:file_object id="obj_{{{ rule_id }}}_config_file" comment="The configuration file {{{ filepath_regex }}} for {{{ rule_id }}}" version="1">
    <unix:filepath operation="pattern match">^{{{ filepath_regex }}}</unix:filepath>
  </unix:file_object>
{{%- endmacro %}}


{{#
  Macro to define the OVAL test to check if there is a line in file with a pair of argument=value (Criterion definition).

:param filepath: Path to the file to be checked.
:type filepath: str
:param name: Argument name
:type name: str
:param value: Argument value (Optional)
:type value: str
:param application: The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
:type application: str
:param negate: Whether to negate this criterion or not
:type negate: bool

#}}
{{%- macro oval_argument_value_in_line_criterion(filepath, name, value='', application='', negate=False) -%}}
{{%- if value -%}}
{{%- set name_value = name+"="+value -%}}
{{%- else -%}}
{{%- set name_value = name -%}}
{{%- endif -%}}
  <criterion comment="Check if argument {{{ name_value }}}{{% if application %}} for {{{ application }}}{{% endif %}} is {{% if negate %}}not {{% endif %}}present in {{{ filepath }}}"
  test_ref="test_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}" {{% if negate %}}negate="true" {{% endif %}}/>
{{%- endmacro -%}}


{{#
  Macro to define the OVAL test to check if there is a line in file with a pair of argument=value (Test definition).

:param filepath: Path to the configuration file to be checked. The operation is "pattern match"
:type filepath: str
:param name: Argument name
:type name: str
:param value: Argument value (Optional)
:type value: str
:param line_prefix: The starting part of the line with the list of arguments, default is empty
:type line_prefix: str
:param line_suffix: The ending part of the line with the list of arguments, default is empty
:type line_suffix: str
:param is_regex: Defines whether the given name or value is a regex
:type is_regex: bool

#}}
{{%- macro oval_argument_value_in_line_test(filepath, name, value='', line_prefix='', line_suffix='', is_regex=False) -%}}
{{%- if value -%}}
  {{%- set name_value = name+"="+value -%}}
{{%- else -%}}
  {{%- set name_value = name -%}}
{{%- endif -%}}
{{%- if is_regex -%}}
  {{%- set processed_name_value = name_value -%}}
{{%- else -%}}
  {{%- set processed_name_value = name_value|escape_regex -%}}
{{%- endif -%}}
  <ind:textfilecontent54_test id="test_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}"
  comment="Check if argument {{{ name_value }}} is present{{% if line_prefix %}} in the line starting with '{{{ line_prefix }}}'{{% endif %}} in {{{ filepath }}}"
  check="all" check_existence="all_exist" version="1">
    <ind:object object_ref="object_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}" />
    <ind:state state_ref="state_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}" version="1">
    <ind:filepath operation="pattern match">^{{{ filepath }}}</ind:filepath>
    <ind:pattern operation="pattern match">^{{{ line_prefix|escape_regex }}}(.*){{{ line_suffix|escape_regex }}}$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_state id="state_{{{ rule_id }}}_{{{ name_value|escape_id }}}_argument_in_{{{ filepath|escape_id }}}" version="1">
    <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?{{{ processed_name_value }}}(?:\s.*)?$</ind:subexpression>
  </ind:textfilecontent54_state>
{{%- endmacro -%}}


{{#
  High level macro to define the OVAL test to check if there is a line in file with a pair of argument=value.

:param filepath: Path to the configuration file to be checked.
:type filepath: str
:param name: Argument name
:type name: str
:param value: Argument value
:type value: str
:param line_prefix: The starting part of the line with the list of arguments, default is empty
:type line_prefix: str
:param line_suffix: The ending part of the line with the list of arguments, default is empty
:type line_suffix: str

#}}
{{%- macro oval_argument_value_in_line(filepath, name, value, line_prefix='', line_suffix='') -%}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="2">
    {{{ oval_metadata("Ensure argument " + name + "=" + value + " is present"+ (" in the line starting with '" + line_prefix + "'" if line_prefix else "") + " in file(s) '" + filepath + "'") }}}
    <criteria operator="AND">
      {{{- oval_argument_value_in_line_criterion(filepath, name, value, application) }}}
    </criteria>
  </definition>
  {{{- oval_argument_value_in_line_test(filepath, name, value, line_prefix, line_suffix) }}}
</def-group>
{{%- endmacro -%}}

{{#
  High level macro to check if a particular shell variable is set.

:param path: Path to the file.
:type path: str
:param parameter: The shell variable name.
:type parameter: str
:param value: The variable value WITHOUT QUOTES.
:type value: str
:param application: The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
:type application: str
:param no_quotes: If set, the check will require that the RHS of the assignment is the literal value, without quotes. If no_quotes is false, then one level of single or double quotes won't be regarded as part of the value by the check.
:type no_quotes: bool
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param missing_config_file_fail: If set, the check will fail if the configuration file doesn't exist in the system.
:type missing_config_file_fail: bool

#}}
{{%- macro oval_check_shell_file(path, parameter='', value='', application='', no_quotes=false, missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false) %}}
{{% if no_quotes -%}}
  {{%- set quotes = "" -%}}
{{%- else -%}}
  {{%- set quotes = "\"'" -%}}
{{%- endif -%}}
{{% if "$" in value %}}
  {{% set value = '%s' % value.replace("$", "\\$") %}}
{{% endif %}}
{{{ oval_check_config_file(path, prefix_regex="^[ \\t]*", parameter=parameter, separator_regex='=', value=value, missing_parameter_pass=missing_parameter_pass, application=application, multi_value=multi_value, missing_config_file_fail=missing_config_file_fail, quotes=quotes) }}}
{{%- endmacro %}}

{{#
  High level macro to check if a particular configuration variable is set in application master config file or its dropin includes

:param path: Path to the master configuration file.
:type path: str
:param dropin_dir: Path to the dropin directory
:type dropin_dir: str
:param section: optional section if the file has an ini-like format
:type section: str
:param parameter: The shell variable name.
:type parameter: str
:param value: The variable value WITHOUT QUOTES.
:type value: str
:param application: The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
:type application: str
:param no_quotes: If set, the check will require that the RHS of the assignment is the literal value, without quotes. If no_quotes is false, then one level of single or double quotes won't be regarded as part of the value by the check.
:type no_quotes: bool
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param missing_config_file_fail: If set, the check will fail if the configuration file doesn't exist in the system.
:type missing_config_file_fail: bool
#}}

{{%- macro oval_check_dropin_file(path, dropin_dir, section='', parameter='', value='', application='', no_quotes=false, missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false) %}}
<def-group>
  {{%- set prefix_regex = "^[ \\t]*" -%}}
  {{%- set separator_regex = '=' -%}}
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Ensure '" + parameter + "' is configured with value '" + value | replace("(?i)", "") | replace("(?-i)", "") + (" in section '" + section if section else "") + "' in " + path) }}}
    {{%- if missing_config_file_fail %}}
    <criteria comment="{{{ application }}} is configured correctly and configuration file exists"
    operator="AND">
    {{%- endif %}}

    <criteria comment="{{{ application }}} is configured correctly"
    operator="OR">
        {{{- oval_line_in_file_criterion(path, parameter) }}}
        {{%- if missing_parameter_pass %}}
        {{{- oval_line_in_file_criterion(path, parameter, missing_parameter_pass) }}}
        {{%- endif %}}
        {{{ oval_line_in_file_criterion(dropin_dir, parameter, missing_parameter_pass, "", rule_id ~ "_dropin_file") }}}
    </criteria>
    {{%- if missing_config_file_fail %}}
        {{{- oval_config_file_exists_criterion(path) }}}
    </criteria>
    {{%- endif %}}
  </definition>

  {{%- set quotes = "'\"" -%}}
  {{%- if no_quotes == "true" %}}
  {{%- set quotes = "" -%}}
  {{%- endif %}}

  {{{ oval_line_in_file_test(path, parameter) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, false, multi_value) }}}
  {{{ oval_line_in_file_state(value, multi_value, quotes) }}}
  {{%- if missing_parameter_pass %}}
  {{{ oval_line_in_file_test(path, parameter, missing_parameter_pass) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, missing_parameter_pass, multi_value) }}}
  {{%- endif %}}
  {{%- if missing_config_file_fail %}}
  {{{ oval_config_file_exists_test(path) }}}
  {{{ oval_config_file_exists_object(path) }}}
  {{%- endif %}}
  {{{ oval_line_in_file_test(dropin_dir, parameter, missing_parameter_pass, rule_id ~ "_dropin_file") }}}
  {{{ oval_line_in_file_object(dropin_dir, section, prefix_regex, parameter, separator_regex, false, multi_value,'^.*\.conf$', rule_id ~ "_dropin_file") }}}
  {{{ oval_line_in_file_state(value, multi_value, quotes, rule_id ~ "_dropin_file") }}}

</def-group>
{{%- endmacro %}}



{{#
  High level macro to check if a particular combination of parameter and value in the Audit daemon configuration file is set.

:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param missing_config_file_fail: If set, the check will fail if the configuration file doesn't exist in the system.
:type missing_config_file_fail: bool

#}}
{{%- macro oval_auditd_config(parameter='', value='', missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false) %}}
{{{ oval_check_config_file("/etc/audit/auditd.conf", prefix_regex="^[ \\t]*(?i)", parameter=parameter, separator_regex='(?-i)[ \\t]*=[ \\t]*', value="(?i)"+value+"(?-i)", missing_parameter_pass=missing_parameter_pass, application="auditd", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail) }}}
{{%- endmacro %}}


{{#
  High level macro to set a parameter in /etc/systemd/coredump.conf and /etc/systemd/coredump.conf.d/*.conf

:param parameter: The parameter to be checked in the configuration file(s).
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool

#}}
{{%- macro oval_coredump_config_set(parameter='', value='', missing_parameter_pass=false, multi_value=false) %}}
{{{ oval_check_systemd_config("/etc/systemd/coredump.conf", prefix_regex="^[ \\t]*(?i)", parameter=parameter, separator_regex='(?-i)[ \\t]*=[ \\t]*', value="(?i)"+value+"(?-i)", missing_parameter_pass=missing_parameter_pass, application="systemd-coredump", multi_value=multi_value, section="Coredump") }}}
{{%- endmacro %}}


{{#
  High level macro to check if a particular combination of parameter and value in the grub configuration file is set.

:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param missing_config_file_fail: If set, the check will fail if the configuration is not existent in the system.
:type missing_config_file_fail: bool

#}}
{{%- macro oval_grub_config(parameter='', value='', missing_parameter_pass=false, multi_value=true, missing_config_file_fail=false) %}}
{{{ oval_check_config_file("/etc/default/grub", prefix_regex="^[ \\t]*", parameter=parameter, separator_regex='=', value=value, missing_parameter_pass=missing_parameter_pass, application="grub", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail) }}}
{{%- endmacro %}}


{{#
  To be removed macro. Prevents regression on sshd configuration rules.
#}}
{{%- macro application_not_required_or_requirement_unset() -%}}
      <criteria comment="sshd is not installed" operator="AND">
        <extend_definition comment="sshd is not required or requirement is unset"
        definition_ref="sshd_not_required_or_unset" />
        {{% if product in ['opensuse', 'sle12', 'sle15', 'slmicro5'] %}}
        <extend_definition comment="rpm package openssh removed"
        definition_ref="package_openssh_removed" />
        {{% else %}}
        <extend_definition comment="rpm package openssh-server removed"
        definition_ref="package_openssh-server_removed" />
        {{% endif %}}
      </criteria>
{{%- endmacro %}}


{{#
  To be removed macro. Prevents regression on sshd configuration rules.
#}}
{{%- macro application_required_or_requirement_unset() -%}}
      <criteria comment="sshd is installed and configured" operator="AND">
        <extend_definition comment="sshd is required or requirement is unset"
        definition_ref="sshd_required_or_unset" />
        {{% if product in ['opensuse', 'sle12', 'sle15', 'slmicro5'] %}}
        <extend_definition comment="rpm package openssh installed"
        definition_ref="package_openssh_installed" />
        {{% else %}}
        <extend_definition comment="rpm package openssh-server installed"
        definition_ref="package_openssh-server_installed" />
        {{% endif %}}
      {{# Note that a criteria was left open #}}
{{%- endmacro %}}


{{#
  High level macro which checks configuration in an INI file.

:param path: Path to the configuration file to be checked.
:type path: str
:param section: The parameter will be checked only within the given section defined by [section].
:type section: str
:param parameter: The parameter to be checked in the configuration file.
:type parameter: str
:param value: The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
:type value: str
:param missing_parameter_pass: If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
:type missing_parameter_pass: bool
:param application: The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
:type application: str
:param multi_value: If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
:type multi_value: bool
:param missing_config_file_fail: If set, the check will fail if the configuration is not existent in the system.
:type missing_config_file_fail: bool

#}}
{{%- macro oval_check_ini_file(path='', section='', parameter='', value='', missing_parameter_pass=false, application='', multi_value=false, missing_config_file_fail=true) %}}
{{{ oval_check_config_file(path=path, prefix_regex="^\s*", parameter=parameter, value=value, separator_regex="[ \\t]*=[ \\t]*", missing_parameter_pass=missing_parameter_pass, application=application, multi_value=multi_value, missing_config_file_fail=missing_config_file_fail, section=section) }}}
{{%- endmacro %}}


{{#
  Creates OVAL tests with given test_id which checks if package
  is not installed.

:param package: Name of the package to be removed
:type package: str
:param test_id: Suffix of the Ids in test, obj, and state elements
:type test_id: str

#}}
{{%- macro oval_test_package_removed(package='', test_id='') -%}}
{{% if pkg_system == "rpm" %}}
  <linux:rpminfo_test check="all" check_existence="none_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is removed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
  </linux:rpminfo_test>
  <linux:rpminfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:rpminfo_object>
{{% elif pkg_system == "dpkg" %}}
  <linux:dpkginfo_test check="all" check_existence="none_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is removed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
  </linux:dpkginfo_test>
  <linux:dpkginfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:dpkginfo_object>
{{% endif %}}
{{%- endmacro -%}}


{{#
  Creates OVAL tests with given test_id which checks if package
  is installed. Optionally, it can check if a package of a given version (EVR)
  or newer version is present.

:param package: Name of the package to be installed
:type package: str
:param evr: Optional, version or newer version to check
:type evr: str
:param test_id: Suffix of the Ids in test, obj, and state elements
:type test_id: str

#}}
{{%- macro oval_test_package_installed(package='', evr='', evr_op='greater than or equal', test_id='') -%}}
{{% if pkg_system == "rpm" %}}
  <linux:rpminfo_test check="all" check_existence="all_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is installed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
    {{% if evr %}}
      <linux:state state_ref="ste_{{{ test_id }}}" />
    {{% endif %}}
  </linux:rpminfo_test>
  <linux:rpminfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:rpminfo_object>
  {{% if evr %}}
    <linux:rpminfo_state id="ste_{{{ test_id }}}" version="1">
      <linux:evr datatype="evr_string" operation="{{{ evr_op }}}">{{{ evr }}}</linux:evr>
    </linux:rpminfo_state>
  {{% endif %}}
{{% elif pkg_system == "dpkg" %}}
  <linux:dpkginfo_test check="all" check_existence="all_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is installed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
    {{% if evr %}}
      <linux:state state_ref="ste_{{{ test_id }}}" />
    {{% endif %}}
  </linux:dpkginfo_test>
  <linux:dpkginfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:dpkginfo_object>
  {{% if evr %}}
    <linux:dpkginfo_state id="ste_{{{ test_id }}}" version="1">
      <linux:evr datatype="evr_string" operation="{{{ evr_op }}}">{{{ evr }}}</linux:evr>
    </linux:dpkginfo_state>
  {{% endif %}}
{{% endif %}}
{{%- endmacro -%}}


{{#
  Macro which generates OVAL test for OpenShift Container Platform
  runtime process configuration.

:param command: command that executes the OpenShift process
:type command: str
:param option: command line option of the command
:type option: str
:param value: value of the option
:type value: str
:param option_id: used to build the OVAL test ID. The OVAL test ID is test_ocp_runtime_<option_id>.
:type option_id: str

#}}
{{%- macro oval_ocp_service_runtime_config(command='', option='', value='', option_id='') -%}}
  <unix:process58_test check="all" comment="ocp process runtime parameter {{{ option }}} set to {{{ value }}}" id="test_ocp_runtime_{{{ option_id }}}" version="1">
    <unix:object object_ref="object_ocp_runtime_{{{ option_id }}}" />
    <unix:state state_ref="state_ocp_runtime_{{{ option_id }}}" />
  </unix:process58_test>
  <unix:process58_object id="object_ocp_runtime_{{{ option_id }}}" version="1">
    <unix:command_line operation="pattern match">^{{{ command }}}.*$</unix:command_line>
    <unix:pid datatype="int" operation="greater than">0</unix:pid>
  </unix:process58_object>
  <unix:process58_state id="state_ocp_runtime_{{{ option_id }}}" version="1">
    <unix:command_line operation="pattern match">^.*[\s]+{{{ option }}}=.*({{{ value }}}).*([\s]+.*$|$)</unix:command_line>
  </unix:process58_state>
{{%- endmacro -%}}


{{#
  Macro which generates OVAL definition, test and object that check for contents
  of the file.

:param filepath: filepath of the file to check
:type filepath: str
:param filepath_id: Used like test_whole_file_contents_$filepath_id
:type filepath_id: str
:param contents: contents that should be in the file
:type contents: str

#}}
{{%- macro oval_file_contents(filepath='', filepath_id='', contents='') -%}}
  <def-group>
    <definition class="compliance" id="{{{ rule_id }}}" version="1">
      {{{ oval_metadata("Inspect the contents of " + filepath) }}}
      <criteria>
          <criterion comment="Check contents of file" test_ref="{{{ rule_id }}}_test_whole_file_contents_{{{ filepath_id }}}" />
      </criteria>
    </definition>

    <ind:textfilecontent54_test check="all" check_existence="all_exist"
    comment="Tests if contents of {{{ filepath }}} is exactly what is defined in rule description"
    id="{{{ rule_id }}}_test_whole_file_contents_{{{ filepath_id }}}" version="1">
      <ind:object object_ref="{{{ rule_id }}}_object_whole_file_contents_{{{ filepath_id }}}" />
      <ind:state state_ref="{{{ rule_id }}}_state_whole_file_contents_{{{ filepath_id }}}" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="{{{ rule_id }}}_object_whole_file_contents_{{{ filepath_id }}}" version="1">
      <ind:behaviors singleline="true" multiline="false" />
      <ind:filepath>{{{ filepath }}}</ind:filepath>
      <ind:pattern operation="pattern match">^.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_state id="{{{ rule_id }}}_state_whole_file_contents_{{{ filepath_id }}}" version="1">
      <ind:text operation="equals">{{{ contents }}}
</ind:text>
    </ind:textfilecontent54_state>

  </def-group>
{{%- endmacro %}}


{{#
  Macro which generates the OVAL metadata section

:param description: The text to place in the description section
:type description: str
:param title: Optional, the associated rule title is used by default
:type title: str
:param affected_platforms: Optional, list of unix platform strings (e.g. "Fedora") to put under the affected element. Uses the oval_affected macro by default under the hood.
:type affected_platforms: list[str]

#}}
{{%- macro oval_metadata(description, title="", affected_platforms=None) -%}}
    <metadata>
{{%- if title %}}
        <title>{{{ title }}}</title>
{{%- else %}}
        <title>{{{ rule_title }}}</title>
{{%- endif -%}}
{{%- if affected_platforms %}}
            <affected family="unix">
{{%- for platform in affected_platforms %}}
                <platform>{{{ platform }}}</platform>
{{%- endfor %}}
            </affected>
{{%- else %}}
        {{{ oval_affected(products) | indent -}}}
{{%- endif %}}
        <description>{{{ description }}}{{{ caller() if caller else '' }}}</description>
    </metadata>
{{%- endmacro %}}


{{#
    Create a full OVAL check for dconf ini file.

:param path: Path to the file
:type path: str
:param prefix_regex: Defaults to ^\s*. What can prefix the parameter.
:type prefix_regex: str
:param parameter: What parameter to be set.
:type parameter: str
:param separator_regex: Defaults to [ \\t]*=[ \\t]*. What is the separator between the parameter and value.
:type separator_regex: str
:param value: What value to be set
:type value: str
:param application: What application this applies to
:type application: str
:param section: What section this applies to
:type section: str
:param quotes:  If non-empty, one level of matching quotes is considered when checking the value. Specify one or more quote types as a string.  For example, for shell quoting, specify quotes="'\""), which will make sure that value, 'value' and "value" are matched, but 'value" or '"value"' won't be.
:type quotes: str
:param lock_path: Path to lock file
:type lock_path: str

#}}
{{%- macro oval_check_dconf_ini_file(path='', prefix_regex='^\s*', parameter='', separator_regex='[ \\t]*=[ \\t]*', value='', application='', section='', quotes='', lock_path='') -%}}
{{%- if application == '' -%}}
	{{%- set application = "The respective application or service" -%}}
{{%- endif -%}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Ensure '" + parameter + "' is configured with value '" + value | replace("(?i)", "") | replace("(?-i)", "") + (" in section '" + section if section else "") + "' in " + path) }}}
    <criteria comment="{{{ application }}} is configured correctly"
    operator="AND">
        {{{- oval_line_in_file_criterion(path, parameter) }}}
      <criterion comment="Prevent user from modifying {{{ parameter }}}"
      test_ref="test_prevent_user_{{{ parameter }}}" />
    </criteria>
  </definition>
  {{{ oval_line_in_file_test(path, parameter) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, false, false, filename_regex='^.*$') }}}
  {{{ oval_line_in_file_state(value, false, quotes) }}}

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Prevent user from modifying {{{ parameter }}}"
  id="test_prevent_user_{{{ parameter }}}" version="1">
    <ind:object object_ref="obj_prevent_user_{{{ parameter }}}" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_prevent_user_{{{ parameter }}}"
  version="1">
    <ind:path>{{{ lock_path }}}</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">^/{{{ section }}}/{{{ parameter }}}$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
{{%- endmacro %}}


{{#
    Create a full OVAL check for an sshd parameter and value.

:param parameter: Parameter to check
:type parameter: str
:param value: Value to check
:type value: str
:param missing_parameter_pass: If true, the check will pass if the parameter missing.
:type missing_parameter_pass: bool
:param config_is_distributed: Is the param in /etc/sshd_config.d vs just /etc/ssh/sshd_config
:type config_is_distributed: bool
:param xccdf_variable: the name of an XCCDF variable carrying the value, this conflicts with the value parameter
:type xccdf_variable: str
:param datatype: a data type of the value
:type datatype: str

#}}
{{%- macro sshd_oval_check(parameter, value, missing_parameter_pass, config_is_distributed, xccdf_variable="", datatype="") -%}}
{{%- set sshd_config_path = "/etc/ssh/sshd_config" %}}
{{%- set sshd_config_dir = "/etc/ssh/sshd_config.d" -%}}
{{%- if xccdf_variable -%}}
{{%- set description = "Ensure '" ~ parameter ~ "' is configured with value configured in " ~ xccdf_variable ~ " variable in " ~ sshd_config_path %}}
{{%- else -%}}
{{%- set description = "Ensure '" ~ parameter ~ "' is configured with value '" ~ value ~ "' in " ~ sshd_config_path %}}
{{%- endif -%}}
{{%- if config_is_distributed == "true" %}}
{{%- set description = description  ~ " or in " ~ sshd_config_dir -%}}
{{%- endif %}}
{{%- set case_insensitivity_kwargs = dict(prefix_regex="^[ \\t]*(?i)", separator_regex = "(?-i)[ \\t]+") -%}}

<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
   {{{ oval_metadata(description) }}}
   <criteria comment="sshd is configured correctly or is not installed" operator="OR">
     <criteria comment="sshd is not installed" operator="AND">
        <extend_definition comment="sshd is not required or requirement is unset"
          definition_ref="sshd_not_required_or_unset" />
          {{% if product in ['opensuse', 'sle12','sle15', 'slmicro5'] %}}
          <extend_definition definition_ref="package_openssh_removed"
          comment="rpm package openssh removed"/>
          {{% else %}}
           <extend_definition comment="rpm package openssh-server removed"
           definition_ref="package_openssh-server_removed" />
          {{% endif %}}
     </criteria>
     <criteria comment="sshd is installed and configured" operator="AND">
        <extend_definition comment="sshd is required or requirement is unset"
          definition_ref="sshd_required_or_unset" />
        {{% if product in ['opensuse', 'sle12','sle15', 'slmicro5'] %}}
        <extend_definition comment="rpm package openssh installed"
          definition_ref="package_openssh_installed" />
        {{% else %}}
        <extend_definition comment="rpm package openssh-server installed"
          definition_ref="package_openssh-server_installed" />
        {{% endif %}}
        <criteria comment="sshd is configured correctly" operator="AND">
          <criteria comment="the configuration is correct if it exists" operator="AND">
            {{{- oval_line_in_file_criterion(sshd_config_path, parameter, avoid_conflicting=true) | indent(10)}}}
            {{%- if config_is_distributed == "true" %}}
            {{{- oval_line_in_directory_criterion(sshd_config_dir, parameter, avoid_conflicting=true) | indent(10) }}}
            {{%- endif %}}
            {{% if product in ["ol8", "ol9"] %}}
            {{{- oval_line_in_file_criterion("sshd_config included", parameter, id_stem=rule_id ~ "_sshd_included_files", avoid_conflicting=true) | indent(10)}}}
            {{% endif %}}
          </criteria>
          {{%- if not missing_parameter_pass %}}
          <criterion comment="the configuration exists" test_ref="test_{{{ parameter }}}_present_{{{ rule_id }}}" />
          {{% endif %}}
        </criteria>
      </criteria>
    </criteria>
  </definition>

{{% if xccdf_variable %}}
{{{ oval_line_in_file_define_variable(xccdf_variable, datatype) }}}
{{% endif %}}

  {{% if product in ["ol8", "ol9"] %}}
  {{{ oval_line_in_file_object(sshd_config_path, parameter="include", id_stem="sshd_include_value_" ~ rule_id, ** case_insensitivity_kwargs)| indent (2) }}}
  <local_variable id="var_sshd_config_included_files_{{{ rule_id }}}" datatype="string" version="1"
  comment="Include value converted to regex">
    <concat>
      <literal_component>^(/etc/ssh/(?!/))?</literal_component>
      <substring substring_start="2" substring_length="-1">
        <unique>
          <glob_to_regex>
            <object_component item_field="subexpression" object_ref="obj_sshd_include_value_{{{ rule_id }}}" />
          </glob_to_regex>
        </unique>
      </substring>
    </concat>
  </local_variable>

  {{{ oval_line_in_file_test("sshd_config included", parameter, id_stem=rule_id ~ "_sshd_included_files", avoid_conflicting=true ) | indent (2) }}}

  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}_sshd_included_files" version="1">
    <ind:filepath operation="pattern match" var_ref="var_sshd_config_included_files_{{{ rule_id }}}" var_check="at least one"/>
    <ind:pattern operation="pattern match">^[ \t]*(?i){{{ parameter }}}(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  {{%- if xccdf_variable -%}}
  {{{ oval_line_in_file_state_xccdf_variable(xccdf_variable, id_stem=rule_id ~ "_sshd_included_files", datatype=datatype) | indent (2) }}}
  {{%- else -%}}
  {{{ oval_line_in_file_state(value, id_stem=rule_id ~ "_sshd_included_files") | indent (2) }}}
  {{%- endif -%}}

  {{% endif %}}

  {{{ oval_line_in_file_test(sshd_config_path, parameter, avoid_conflicting=true ) | indent (2) }}}
  {{{ oval_line_in_file_object(sshd_config_path, parameter=parameter, ** case_insensitivity_kwargs)| indent (2) }}}
  {{%- if xccdf_variable -%}}
  {{{ oval_line_in_file_state_xccdf_variable(xccdf_variable, datatype=datatype) }}}
  {{%- else -%}}
  {{{ oval_line_in_file_state(value) | indent (2) }}}
  {{%- endif -%}}

  {{%- if config_is_distributed == "true" %}}
  {{{ oval_line_in_directory_test(sshd_config_dir, parameter, avoid_conflicting=true) | indent (2) }}}
  {{{ oval_line_in_directory_object(sshd_config_dir, parameter=parameter, ** case_insensitivity_kwargs) | indent (2) }}}
  {{%- if xccdf_variable -%}}
  {{{ oval_line_in_directory_state_xccdf_variable(xccdf_variable, datatype) | indent (2) }}}
  {{%- else -%}}
  {{{ oval_line_in_directory_state(value) | indent (2) }}}
  {{%- endif -%}}
  {{%- endif %}}

  {{% if not missing_parameter_pass %}}
  <ind:textfilecontent54_object comment="All confs collection" id="obj_collection_obj_{{{ rule_id }}}" version="1">
    <set>
      <object_reference>obj_{{{ rule_id }}}</object_reference>
      {{%- if config_is_distributed == "true" %}}
      <object_reference>obj_{{{ rule_id }}}_config_dir</object_reference>
      {{% elif product in ["ol8", "ol9"] %}}
      <object_reference>obj_{{{ rule_id }}}_sshd_included_files</object_reference>
      {{%- endif %}}
    </set>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_{{{ parameter }}}_present_{{{ rule_id }}}" version="1"
                              check="all" check_existence="at_least_one_exists"
                              comment="Verify that the value of {{{ parameter }}} is present">
    <ind:object object_ref="obj_collection_obj_{{{ rule_id }}}" />
  </ind:textfilecontent54_test>

  {{% endif %}}
</def-group>
{{%- endmacro %}}


{{#
  Extract from system password database a list composed of password objects related to non-system UIDs.
  This list is then filtered to exclude some special usernames and users with /sbin/nologin shell.
  The list includes non-local (LDAP) users, because the implementation of "unix:password_object" in OpenSCAP makes use of getpwent(), which browses all users provided by the NSS.

  The macro receives a string as parameter, which is used as the password_object id in the rule.

:param object_id: Object id to be created.
:type object_id: str
:param include_root: If set to true, the "root" user account will be included to the list. Default: False.
:type include_root: bool

#}}
{{%- macro create_interactive_users_list_object(object_id, include_root=False) -%}}
  {{%- set ignored_users_list="(nobody|nfsnobody)" %}}

  <unix:password_object id="{{{ object_id }}}" version="1">
    <set>
      {{% if include_root %}}
        <object_reference>{{{ object_id }}}_root</object_reference>
      {{% endif %}}
      <object_reference>{{{ object_id }}}_others</object_reference>
    </set>
  </unix:password_object>

  {{% if include_root %}}
    <unix:password_object id="{{{ object_id }}}_root" version="1">
      <unix:username datatype="string" operation="equals">root</unix:username>
    </unix:password_object>
  {{% endif %}}

  <unix:password_object id="{{{ object_id }}}_others" version="1">
    <unix:username datatype="string" operation="pattern match">.*</unix:username>
    <filter action="include">state_{{{ rule_id }}}_users_uids</filter>
    <filter action="exclude">state_{{{ rule_id }}}_users_ignored</filter>
    <filter action="exclude">state_{{{ rule_id }}}_users_nologin_shell</filter>
  </unix:password_object>

  <unix:password_state id="state_{{{ rule_id }}}_users_uids" version="1">
    <unix:user_id datatype="int" operation="greater than or equal">{{{ uid_min }}}</unix:user_id>
  </unix:password_state>

  <unix:password_state id="state_{{{ rule_id }}}_users_ignored" version="1">
    <unix:username datatype="string" operation="pattern match">^{{{ ignored_users_list }}}$</unix:username>
  </unix:password_state>

  <unix:password_state id="state_{{{ rule_id }}}_users_nologin_shell" version="1">
    <unix:login_shell datatype="string" operation="pattern match">^/sbin/nologin$</unix:login_shell>
  </unix:password_state>
{{%- endmacro %}}


{{#
  Extract from /etc/passwd a list of specified fields of local interactive users.
  The list contains only items related to non-system UIDs and is filtered to exclude some special usernames and users with /sbin/nologin and /bin/false shell.

  Unlike macro create_interactive_users_list_object, this macro gives list that contains only local users, because it doesn't use the OVAL "unix:password_object" element, but it merely parses /etc/passwd using "ind:textfilecontent54_object".

  The macro receives a string as parameter, which is used as the textfilecontent54_object ID in the rule.

:param object_id: Object ID to be created.
:type object_id: str
:param second_literal_component_regex: regex in the second literal_component of the concat element of the local variable that forms the regex describing an username row
:type second_literal_component_regex: str

#}}
{{%- macro create_local_interactive_users_object(object_id, second_literal_component_regex) -%}}


  <!-- OVAL object to collect home directories of local interactive users -->
  <ind:textfilecontent54_object id="{{{ object_id }}}" version="1">
    <ind:filepath>/etc/passwd</ind:filepath>
    <!-- Home directories from /etc/passwd (6th column) captured as subexpression of this object -->
    <ind:pattern operation="pattern match" var_ref="variable_{{{ object_id }}}_regex" var_check="at least one"/>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>


  <local_variable id="variable_{{{ object_id }}}_regex" datatype="string" version="1" comment="usernames rows retrieved from /etc/passwd">
    <concat>
      <literal_component>^(?:</literal_component>
      <object_component item_field="subexpression" object_ref="{{{ object_id }}}_local_interactive_users" />
      <literal_component>{{{ second_literal_component_regex }}}</literal_component>
    </concat>
  </local_variable>

  <!-- OVAL object to collect user names of local interactive users -->
  <ind:textfilecontent54_object id="{{{ object_id }}}_local_interactive_users" version="1">
    <ind:filepath>/etc/passwd</ind:filepath>
    <!-- The regex matches only user entries with UID greater than or
      equal 1000. The users whose UID is greater than or equal 1000 are
      considered interactive users. This is achieved by ':\d{4,}:' in the
      regular expression which ensures that the third field in the entry
      contains at least 4 digits (or more) and therefore the regular
      expression doesn't match entries with values 999 or less. -->
    <ind:pattern operation="pattern match">^([^:]*):[^:]*:\d{4,}:(?:[^:]*:){3}(?!(\/usr)?(\/sbin\/nologin|\/bin\/false))[^:]*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    <filter action="exclude">state_{{{ object_id }}}_users_ignored</filter>
  </ind:textfilecontent54_object>

  {{%- set ignored_users_list="(nobody|nfsnobody)" %}}
  <ind:textfilecontent54_state id="state_{{{ object_id }}}_users_ignored" version="1">
    <ind:subexpression operation="pattern match">^{{{ ignored_users_list }}}$</ind:subexpression>
  </ind:textfilecontent54_state>

{{%- endmacro %}}


{{#
  Extract from /etc/passwd a list of home directories of local interactive users.
  The list contains only items related to non-system UIDs and is filtered to exclude some special usernames and users with /sbin/nologin and /bin/false shell.

  Unlike macro create_interactive_users_list_object, this macro gives list that contains only local users, because it doesn't use the OVAL "unix:password_object" element, but it merely parses /etc/passwd using "ind:textfilecontent54_object".

  The macro receives a string as parameter, which is used as the textfilecontent54_object ID in the rule.

:param object_id: Object ID to be created.
:type object_id: str

#}}
{{%- macro create_local_interactive_users_home_dirs_list_object(object_id) -%}}
{{{ create_local_interactive_users_object(
  object_id=object_id,
  second_literal_component_regex="):(?:[^:]*:){4}([^:]+):[^:]*$") }}}
{{%- endmacro %}}


{{#
  Extract from /etc/passwd a list of User IDs of local interactive users.
  The list contains only items related to non-system UIDs and is filtered to exclude some special usernames and users with /sbin/nologin and /bin/false shell.

  Unlike macro create_interactive_users_list_object, this macro gives list that contains only local users, because it doesn't use the OVAL "unix:password_object" element, but it merely parses /etc/passwd using "ind:textfilecontent54_object".

  The macro receives a string as parameter, which is used as the textfilecontent54_object ID in the rule.

:param object_id: Object ID to be created.
:type object_id: str

#}}
{{%- macro create_local_interactive_users_uids_list_object(object_id) -%}}
{{{ create_local_interactive_users_object(
  object_id=object_id,
  second_literal_component_regex=":)(?:[^:]*:)([^:]+):(?:[^:]*:){3}[^:]*$") }}}
{{%- endmacro %}}


{{#
  Extract from /etc/passwd a list of Group IDs of local interactive users.
  The list contains only items related to non-system UIDs and is filtered to exclude some special usernames and users with /sbin/nologin and /bin/false shell.

  Unlike macro create_interactive_users_list_object, this macro gives list that contains only local users, because it doesn't use the OVAL "unix:password_object" element, but it merely parses /etc/passwd using "ind:textfilecontent54_object".

  The macro receives a string as parameter, which is used as the textfilecontent54_object ID in the rule.

:param object_id: Object ID to be created.
:type object_id: str

#}}
{{%- macro create_local_interactive_users_gids_list_object(object_id) -%}}
{{{ create_local_interactive_users_object(
  object_id=object_id,
  second_literal_component_regex=":)(?:[^:]*:){2}([^:]+):(?:[^:]*:){2}[^:]*$") }}}
{{%- endmacro %}}


{{#
  Extract from /etc/passwd a list composed of password objects related to system UIDs.
  This list is then filtered to exclude some special usernames.

  The macro receives a string as parameter, which is used as the password_object id in the rule.

:param object_id: Object id to be created.
:type object_id: str

#}}
{{%- macro create_system_accounts_list_object(object_id) -%}}
  {{%- set ignored_users_list="(root|halt|sync|shutdown|nfsnobody)" %}}

  <unix:password_object id="{{{ object_id }}}" version="1">
    <unix:username datatype="string" operation="pattern match">.*</unix:username>
    <filter action="include">state_{{{ rule_id }}}_users_uids</filter>
    <filter action="exclude">state_{{{ rule_id }}}_users_ignored</filter>
  </unix:password_object>

  <unix:password_state id="state_{{{ rule_id }}}_users_uids" version="1">
    <unix:user_id datatype="int" operation="less than">{{{ uid_min }}}</unix:user_id>
  </unix:password_state>

  <unix:password_state id="state_{{{ rule_id }}}_users_ignored" version="1">
    <unix:username datatype="string" operation="pattern match">^{{{ ignored_users_list }}}$</unix:username>
  </unix:password_state>
{{%- endmacro %}}


{{#
  Check the system partition table and create a list of mount points referring to devices in /dev.
  The filtered list of mount_points is stored in a local variable to be used in the "path"
  parameter of "file_object" objects.

  When using this variable in the "path" parameter of a "file_object" also make sure the
  "recurse_file_system" parameter is set to "defined" in order to make sure the probe doesn't
  leave the scope of that mount point. For example, when probing "/", the probe will ignore any
  child directory which is a mount point for any other partition. Check the
  "file_permissions_ungroupowned" rule for a reference.

  Using this filtered list of mount points should increate performance and optimize resources
  by skipping the check of a lot unnecessary file objects.

  The macro receives a string as parameter, which is used as the local_variable id in the rule.

:param variable_id: Variable id to be created.
:type variable_id: str

#}}
{{%- macro create_local_mount_points_list(variable_id) -%}}
  <!-- Create a partition_state to filter out remote and special file systems. -->
  <linux:partition_state id="state_{{{ rule_id }}}_dev_partitons" version="1">
    <linux:device operation="pattern match">^/dev/.*$</linux:device>
  </linux:partition_state>

  <!-- This object is created mainly to improve performance when collecting file objects.
       Here all mount points are discovered and filtered to include only devices under /dev in
       order to ignore special and remote file systems. -->
  <linux:partition_object id="object_{{{ rule_id }}}_local_partitions" version="1">
    <linux:mount_point operation="pattern match">.*</linux:mount_point>
    <filter action="include">state_{{{ rule_id }}}_dev_partitons</filter>
  </linux:partition_object>

  <!-- Create a variable composed by mount points referring to devices in /dev.
       There are cases where distributed or remote file systems are also represented as a /dev
       device. For example, when using CEPH. These cases will also be treated as local devices. -->
  <local_variable id="{{{ variable_id }}}" version="1"
    datatype="string" comment="Mount points for local devices">
    <object_component item_field="mount_point"
      object_ref="object_{{{ rule_id }}}_local_partitions"/>
  </local_variable>
{{%- endmacro %}}


{{%- macro mount_active_criterion(path) %}}
   <criterion comment="The path {{{ path }}} is an active (mounted) mount point"
     test_ref="test_mount_active_{{{ path | escape_id }}}_exists" />
{{%- endmacro %}}


{{%- macro mount_configured_fstab_criterion(path) %}}
   <criterion comment="The path {{{ path }}} is a mount point configured in /etc/fstab"
     test_ref="test_mount_configured_fstab_{{{ path | escape_id }}}_exists" />
{{%- endmacro %}}


{{%- macro mount_active_test_object(path) %}}
{{%- set escaped_path = path | escape_id %}}
  <linux:partition_test check="all" check_existence="all_exist" version="1"
      comment="Mountpoint {{{ path }}} exists"
      id="test_mount_active_{{{ escaped_path }}}_exists">
    <linux:object object_ref="object_mount_active_{{{ escaped_path }}}_exists" />
  </linux:partition_test>

  <linux:partition_object id="object_mount_active_{{{ escaped_path }}}_exists" version="1">
    <linux:mount_point>{{{ path }}}</linux:mount_point>
  </linux:partition_object>
{{%- endmacro %}}


{{%- macro mount_configured_fstab_test_object(path) %}}
{{%- set escaped_path = path | escape_id %}}
  <ind:textfilecontent54_test check="all" check_existence="all_exist" version="1"
      comment="Mountpoint {{{ path }}} is configured"
      id="test_mount_configured_fstab_{{{ escaped_path }}}_exists">
    <ind:object object_ref="object_mount_configured_fstab_{{{ escaped_path }}}_exists" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_mount_configured_fstab_{{{ escaped_path }}}_exists" version="1">
    <ind:filepath>/etc/fstab</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*[\S]+[\s]+{{{ path | escape_regex }}}[\s]+[\S]+[\s]+([\S]+)</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
{{%- endmacro %}}


{{#
Generates an OVAL check that checks a particular field in the "/etc/shadow" file.

:param regex: Regex that matches the entries in shadow file and captures the particular field value to a subexpression
:type regex: str
:param regex_empty: Regex that matches the entries in shadow file if the particular field value is empty
:type regex_empty: str

#}}
{{%- macro etc_shadow_test(regex, regex_empty) %}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="3">
      {{{ oval_metadata("Set Existing Passwords Maximum Age") }}}
    <criteria operator="AND">
        <criterion test_ref="test_{{{ rule_id }}}_password_max_life_existing"
          comment="Passwords must be restricted to the appropriate maximum age for existing accounts."/>
        <criterion test_ref="test_{{{ rule_id }}}_password_max_life_existing_minimum"
          comment="Passwords must have a maximum lifetime greater than or equal minimum password age."/>
        <criterion test_ref="test_{{{ rule_id }}}_password_max_life_not_empty"
          comment="Passwords must have the maximum password age set non-empty in /etc/shadow."/>
    </criteria>
  </definition>

  <!-- Define a test for the /etc/shadow file for non-system accounts to look for the maximum
       password change interval. -->
  {{{ textfilecontent54_test_etc_shadow(
    test_id="test_" + rule_id + "_password_max_life_existing",
    regex=regex,
    external_variable_id="var_accounts_maximum_age_login_defs",
    operation="less than or equal") }}}

  <!-- Define a second test to ensure the maximum password life is at least the defined
       minimum (usually 1). -->
  {{{ textfilecontent54_test_etc_shadow(
    test_id="test_" + rule_id + "_password_max_life_existing_minimum",
    regex=regex,
    external_variable_id="var_accounts_minimum_age_login_defs",
    operation="greater than or equal") }}}

  <ind:textfilecontent54_test id="test_{{{ rule_id }}}_password_max_life_not_empty" version="1"
    check="all" check_existence="none_exist"
    comment="Passwords must have the maximum password age set non-empty in /etc/shadow.">
    <ind:object object_ref="object_{{{ rule_id }}}_shadow_password_users_max_life_not_existing"/>
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_{{{ rule_id }}}_shadow_password_users_max_life_not_existing" version="1">
    <ind:filepath>/etc/shadow</ind:filepath>
    <ind:pattern operation="pattern match">{{{ regex_empty }}}</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
{{%- endmacro %}}

{{#
Generates an OVAL test used in checks a particular field in the "/etc/shadow" file.

:param test_id: OVAL test ID
:type test_id: str
:param regex: Regex that matches the entries in shadow file and captures the particular field value to a subexpression
:type regex: str
:param external_variable_id: External variable ID
:type external_variable_id: str
:param operation: operation
:type operation: str

#}}
{{%- macro textfilecontent54_test_etc_shadow(test_id, regex, external_variable_id, operation) -%}}

  <ind:textfilecontent54_test id="{{{ test_id }}}" version="1"
    check="all" check_existence="any_exist"
    comment="Compares a specific field in /etc/shadow with a specific variable value">
    <ind:object object_ref="object_{{{ test_id }}}"/>
    <ind:state state_ref="state_{{{ test_id }}}"/>
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_{{{ test_id }}}" version="1">
    <ind:filepath>/etc/shadow</ind:filepath>
    <ind:pattern operation="pattern match">{{{ regex }}}</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_{{{ test_id }}}" version="1">
    <ind:subexpression datatype="int" operation="{{{ operation }}}" var_check="all"
      var_ref="{{{ external_variable_id }}}"/>
  </ind:textfilecontent54_state>

  <external_variable id="{{{ external_variable_id }}}" datatype="int" version="1"
    comment="External variable"/>
{{%- endmacro %}}

{{#
Generates an OVAL check that checks a particular field in the "/etc/shadow" file and compares it with a given XCCDF Value variable.

:param regex: Regex that matches the entries in shadow file and captures the particular field value to a subexpression
:type regex: str
:param external_variable_id: External variable ID
:type external_variable_id: str
:param operation: operation
:type operation: str
:param description: brief description for OVAL metadata
:type description: str

#}}
{{%- macro test_etc_shadow_password_variable(regex, external_variable_id, operation, description) -%}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata(description) }}}
    <criteria operator="OR">
      <criterion test_ref="test_{{{ rule_id }}}"
        comment="Passwords must be configured to the appropriate value"/>
      <criterion test_ref="test_{{{ rule_id }}}_no_pass"
        comment="There is no password defined in /etc/shadow"/>
    </criteria>
  </definition>

  {{{ textfilecontent54_test_etc_shadow(
    test_id="test_" + rule_id,
    regex=regex,
    external_variable_id=external_variable_id,
    operation=operation) }}}

  <ind:textfilecontent54_test id="test_{{{ rule_id }}}_no_pass" version="1"
    check="all" check_existence="none_exist"
    comment="Check the inexistence of users with a password defined">
    <ind:object object_ref="object_{{{ rule_id }}}_no_pass"/>
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_{{{ rule_id }}}_no_pass" version="1">
    <ind:filepath>/etc/shadow</ind:filepath>
    <ind:pattern operation="pattern match">{{{ regex }}}</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
{{%- endmacro %}}

{{#
  Macro to define service disabled criteria. The definition varies regarding socket configuration
  depending on the oval version. These definitions are used together with the tests defined in
  oval_test_service_disabled_tests macro.

  :param name: Name of the service to be checked
#}}
{{%- macro oval_test_service_disabled_criteria(name='') -%}}
{{%- if init_system == "systemd" %}}
  {{%- if target_oval_version >= [5, 11] %}}
  {{# we are using systemd and our target OVAL version does support the systemd related tests #}}
      <criteria operator="AND" comment="service {{{ name }}} is not configured to start">
        <criterion test_ref="test_service_not_running_{{{ rule_id }}}_{{{ name }}}"
          comment="{{{ name }}} is not running"/>
        <criterion test_ref="test_service_loadstate_is_masked_{{{ rule_id }}}_{{{ name }}}"
          comment="Property LoadState of service {{{ name }}} is masked"/>
      </criteria>
  {{%- else %}}
  {{# fallback if we are using systemd but can't use the new systemd features of OVAL 5.11 #}}
      <criteria operator="AND" comment="service and socket {{{ name }}} are disabled">
        <criterion test_ref="test_{{{ rule_id }}}_{{{ name }}}_disabled_multi_user_target"
          comment="{{{ name }}} disabled in multi-user.target"/>
        <criterion test_ref="test_{{{ rule_id }}}_{{{ name }}}_disabled_sockets_target"
          comment="{{{ name }}} socket disabled in sockets.target"/>
      </criteria>
  {{%- endif %}}
{{% endif %}}
{{%- endmacro -%}}

{{#
  Macro to define service disabled tests. The tests varies depending on the oval version. These
  tests are used together with the definitions defined in oval_test_service_disabled_criteria
  macro.

  :param name: Name of the service to be checked
#}}
{{%- macro oval_test_service_disabled_tests(name='') -%}}
{{%- if init_system == "systemd" %}}
  {{%- if target_oval_version >= [5, 11] %}}
  {{# we are using systemd and our target OVAL version does support the systemd related tests #}}
      <linux:systemdunitproperty_test id="test_service_not_running_{{{ rule_id }}}_{{{ name }}}"
        check="all" check_existence="any_exist"
        comment="Test that the {{{ name }}} service is not running" version="1">
        <linux:object object_ref="obj_service_not_running_{{{ rule_id }}}_{{{ name }}}"/>
        <linux:state state_ref="state_service_not_running_{{{ rule_id }}}_{{{ name }}}"/>
      </linux:systemdunitproperty_test>

    <linux:systemdunitproperty_object id="obj_service_not_running_{{{ rule_id }}}_{{{ name }}}"
      comment="Retrieve the ActiveState property of {{{ name }}}" version="1">
      <linux:unit operation="pattern match">^{{{ name }}}\.(service|socket)$</linux:unit>
      <linux:property>ActiveState</linux:property>
    </linux:systemdunitproperty_object>

    <linux:systemdunitproperty_state id="state_service_not_running_{{{ rule_id }}}_{{{ name }}}"
      version="1" comment="{{{ name }}} is not running">
      <linux:value operation="pattern match">inactive|failed</linux:value>
    </linux:systemdunitproperty_state>

    <linux:systemdunitproperty_test check="all" check_existence="any_exist"
      id="test_service_loadstate_is_masked_{{{ rule_id }}}_{{{ name }}}"
      comment="Test that the property LoadState from the service {{{ name }}} is masked"
      version="1">
      <linux:object object_ref="obj_service_loadstate_is_masked_{{{ rule_id }}}_{{{ name }}}"/>
      <linux:state state_ref="state_service_loadstate_is_masked_{{{ rule_id }}}_{{{ name }}}"/>
    </linux:systemdunitproperty_test>

    <linux:systemdunitproperty_object  comment="Retrieve the LoadState property of {{{ name }}}"
      version="1" id="obj_service_loadstate_is_masked_{{{ rule_id }}}_{{{ name }}}">
      <linux:unit operation="pattern match">^{{{ name }}}\.(service|socket)$</linux:unit>
      <linux:property>LoadState</linux:property>
    </linux:systemdunitproperty_object>

    <linux:systemdunitproperty_state comment="LoadState is set to masked"
      id="state_service_loadstate_is_masked_{{{ rule_id }}}_{{{ name }}}"
      version="1">
      <linux:value>masked</linux:value>
    </linux:systemdunitproperty_state>
  {{%- else %}}
  {{# fallback if we are using systemd but can't use the new systemd features of OVAL 5.11 #}}
      <unix:file_test check="all" check_existence="none_exist"
        comment="look for {{{ name }}}.service in /etc/systemd/system/multi-user.target.wants"
        id="test_{{{ rule_id }}}_{{{ name }}}_disabled_multi_user_target" version="1">
        <unix:object object_ref="object_{{{ rule_id }}}_{{{ name }}}_disabled_multi_user_target"/>
      </unix:file_test>

      <unix:file_object id="object_{{{ rule_id }}}_{{{ name }}}_disabled_multi_user_target"
         comment="look for {{{ name }}}.service in /etc/systemd/system/multi-user.target.wants"
         version="1">
        <unix:filepath>/etc/systemd/system/multi-user.target.wants/{{{ name }}}.service
          </unix:filepath>
        <filter action="include">unit_{{{ rule_id }}}_{{{ name }}}_state_symlink</filter>
      </unix:file_object>

      <unix:file_test check="all" check_existence="none_exist"
        comment="look for {{{ name }}}.socket in /etc/systemd/system/sockets.target.wants"
        id="test_{{{ rule_id }}}_{{{ name }}}_disabled_sockets_target" version="1">
        <unix:object object_ref="object_{{{ rule_id }}}_{{{ name }}}_socket_disabled_sockets_tgt"/>
      </unix:file_test>

      <unix:file_object id="object_{{{ rule_id }}}_{{{ name }}}_socket_disabled_sockets_tgt"
        comment="look for {{{ name }}}.socket in /etc/systemd/system/sockets.target.wants"
        version="1">
        <unix:filepath>/etc/systemd/system/sockets.target.wants/{{{ name }}}.socket</unix:filepath>
        <filter action="include">unit_{{{ rule_id }}}_{{{ name }}}_state_symlink</filter>
      </unix:file_object>

      <unix:file_state id="unit_{{{ rule_id }}}_{{{ name }}}_state_symlink" version="1">
        <unix:type operation="equals">symbolic link</unix:type>
      </unix:file_state>
  {{%- endif %}}
{{%- endif %}}
{{%- endmacro -%}}

{{#
Generate OVAL test that tests if the system is configured to use nss-altfiles
by checking if '/etc/nssswitch.conf' contains 'altfiles' in 'group' key.
The macros generates the OVAL test including the dependent OVAL object and OVAL state.
#}}
{{%- macro oval_test_nsswitch_uses_altfiles() -%}}
<ind:textfilecontent54_test id="test_{{{ rule_id }}}_nsswitch_uses_altfiles" version="1"
  check="all" check_existence="at_least_one_exists"
  comment="Test if /etc/nssswitch.conf contains 'altfiles' in 'group' key">
  <ind:object object_ref="object_{{{ rule_id }}}_nsswitch_uses_altfiles"/>
  <ind:state state_ref="state_{{{ rule_id }}}_nsswitch_uses_altfiles"/>
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_{{{ rule_id }}}_nsswitch_uses_altfiles" version="1">
  <ind:filepath>/etc/nsswitch.conf</ind:filepath>
  <ind:pattern operation="pattern match">^\s*group:\s+(.*)$</ind:pattern>
  <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_{{{ rule_id }}}_nsswitch_uses_altfiles" version="1">
  <ind:subexpression operation="pattern match">altfiles</ind:subexpression>
</ind:textfilecontent54_state>
{{%- endmacro -%}}

{{#
  Macro for checking the system architecture in /proc/sys/kernel/{osrelease,arch}

  :param arch: system architecture (x86_64, aarch64, s90x, ppc64le, ...)
  :type arch: str
#}}
{{%- macro oval_check_proc_sys_kernel_osrelease_arch(arch) -%}}
<def-group>
  <definition class="inventory" id="proc_sys_kernel_osrelease_arch_{{{ arch }}}"
  version="1">
    <metadata>
      <title>Test that the architecture is {{{ arch }}}</title>
      <affected family="unix">
        <platform>multi_platform_all</platform>
      </affected>
      <description>Check that architecture of kernel in /proc/sys/kernel is {{{ arch }}}</description>
    </metadata>
    <criteria>
      <criterion comment="Architecture is {{{ arch }}}"
      test_ref="test_proc_sys_kernel_osrelease_arch_{{{ arch }}}" />
    </criteria>
  </definition>
  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
      comment="proc_sys_kernel is for {{{ arch }}} architecture"
      id="test_proc_sys_kernel_osrelease_arch_{{{ arch }}}" version="1">
    <ind:object object_ref="object_proc_sys_kernel_osrelease_arch_{{{ arch }}}" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_proc_sys_kernel_osrelease_arch_{{{ arch }}}" version="1">
    <ind:filepath operation="pattern match">/proc/sys/kernel/(osrelease|arch)</ind:filepath>
    <ind:pattern operation="pattern match">^.*\.{{{ arch }}}$|^{{{ arch }}}$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
{{%- endmacro -%}}

{{#
Macro to check if external variable is set to value
  :param variable: Name of the external variable to check
  :type variable: str
  :param value: Value of the external variable
  :type value: str
  :param test_id: Suffix of the Ids in test, obj, and state elements
  :type test_id: str
  :param operation: Value operation
  :type operation: str
#}}
{{%- macro oval_test_external_variable_value(variable,value,test_id='',operation='equals') -%}}
  <ind:variable_test id="{{{ test_id }}}"
  comment="Check external {{{ variable }}} is set to {{{ value }}}" check="all" version="1">
    <ind:object object_ref="obj_{{{ test_id }}}"/>
    <ind:state state_ref="ste_{{{ test_id }}}" />
  </ind:variable_test>

  <ind:variable_object id="obj_{{{ test_id }}}" version="1">
    <ind:var_ref>{{{ variable }}}</ind:var_ref>
  </ind:variable_object>
  <ind:variable_state id="ste_{{{ test_id }}}" version="1">
    <ind:value operation="{{{ operation }}}" datatype="string">{{{ value }}}</ind:value>
  </ind:variable_state>

  <external_variable comment="External variable {{{ variable }}}" datatype="string" id="{{{ variable }}}" version="1" />
{{%- endmacro -%}}